Jpm Us Value A Discussion Threads

[early_bird] 02/1/2005 14:43

java disabled

[early_bird] 02/1/2005 14:41

Java disabled

[early_bird] 01/1/2005 23:29

Java disabled

Java disabled

[early_bird] 30/12/2004 19:37

Doris

I only use ie so it isn't working in ie for me.

Have you had any instances at all of this failure in ie?

[doris905] 30/12/2004 16:10

Me too - it was working yesterday. It works in IE but not Firefox

[early_bird] 30/12/2004 13:35

Java Java Java JAVA

DIS DIS DIS DIS

ABLED ABLED ABLED ABLED

[early_bird] 30/12/2004 13:18

JAVA DISABLED

JAVA DISABLED

JAVA DISABLED

[early_bird] 30/12/2004 12:34

Cannot get any ADVFN stock quotes.

Just a big red sign saying JAVA DISABLED.

Then the monitor will work for a few hours.

And then it is back to the big red box telling the woeful tale of JAVA DISABLED.

[optimist] 05/12/2004 20:19

You can check for Java vulnerabilities here

[zzaxx99] 01/12/2004 12:14

See story in about this:

"A vulnerability in a Java plug-in from Sun Microsystems used by most web browsers poses a risk for users of IE and alternative browsers alike. Because of the flaw, malicious applets can escape the safe confines of a sandbox and damage vulnerable systems.

Java Runtime version 1.4.2_05 and older are vulnerable. According to Finnish security researcher Jouko Pynnonen, who discovered the problem, the risk is not limited to IE users but also affects Mozilla Firefox both on Windows and Linux systems. Opera users also at risk.

Similar vulnerabilities have been widely exploited by malicous websites in the past. ..."

The article references that describes the vulnerability:

"...A vulnerability in Java Plugin allows an attacker to create an Applet which can disable Java's security restrictions and break out of the Java sandbox. The attack can be launched when a victim views a web page created by the attacker. Further user interaction is not required as Java Applets are normally loaded and started automatically.

Such Applet can then take any action which the user could: browse, read, or modify files, upload more programs to the victim system and run them, or send out data from the system. Java is a cross-platform language so the same exploit could run on various OS'es and architectures.

Details
There is a number of private Java packages in the Java VM, meant to be used only by the VM internally. Java Applets can't normally access these packages because of security concerns. Attempting to access them normally results in an AccessControlException.

The problem is that java script code can bypass the access control by using so called reflection API. The following piece of example java script acquires a reference to a supposedly restricted, private class "sun.text.Utility":

[script language=java script]
var c=document.applets[0].getClass().forName('sun.text.Utility');
alert('got Class object: '+c)
[/script]

This isn't possible by a normal Java Applet, and shouldn't be for java script either. The java script code could now instantiate the class or pass it to an Applet that could use it.

An attacker can't do much with the utility class in this example, but could use other private classes to exploit the vulnerability. Some of them allow e.g. direct access to memory or contain methods for modifying private fields of other Java objects. The latter allows an attacker to simply turn off the Java security manager, after which there is no sandbox restricting what the Applet can do. ...."

If you are using Sun Java, and have a version of 1.4.2_04 and 1.4.2_05 (and possibly/probably earlier versions), then to close this hole, you need to

[mongrol] 30/9/2004 14:36

The latest Sun JAVA 5.0 (1.5 really is out today and seems to totally break streaming in both IE and Firefox. Though the bonus is the new beta portfolio system doesn't crash firefox anymore. Anyone tried new Sun Java and got it working?

[gala_wanderer] 17/9/2004 08:39

I turned zone alarm back on after loading up the streaming page. It seems to work fine. I'm happy turning it off for a few seconds just to get the page loaded up, less from ideal but what is.

[chiversj] 17/9/2004 08:23

Hi gala_wanderer,

Thanks for the feedback - most appreciated!

What I did was to put you back onto the 'old' codebase. I'm going to move you forward again, onto the new.

You can tell you're using the new by noting the black/yellow 'Java streaming not working for you?' at the top of the page.

Keep ZA off, and let me know if it works still for you

James

[gala_wanderer] 17/9/2004 08:01

ChiversJ

You are totally correct, loaded up in a whistle with ZA turned off. Very impressive, thanks for that.

glentimon, if you're on IE, go to TOOLS > INTERNET OPTIONS and make sure "JIT compiler" is enabled. That might help, when I was playing with my options yesterday, having that disabled would give me a white screen, though previously (with Zonealarm on) I'd get the red X instead.

Again, thanks for the advice chivers, worked like a charm.

p.s. i noticed quite a few people mentioning the same problem as of yesterday, you might want to start a thread on it imho

[chiversj] 17/9/2004 07:53

There's definitely an issue with Zone Alarm and the way in which it handles cookies - we're still investigating. In the mean time, gala_wanderer, I've put your account back to the old version - you may have to nuke your ADVFN Java if it fails to load.

I'll keep you posted on our progress...


Thanks

[glentimon] 17/9/2004 07:34

Something certainly changed yesterday - had to revert to the old monitor whilst at work, as coudn't get the log-in page at all, just a blank white page. Although a relatively new installation with new machines they still run on windows 98, but I'd sorted all the Java/streaming problems weeks ago.

No problems at all at home, very impressed that XP SP2 installed without any problems on both PC and laptop, simply disabled Norton Internet Security Pro and AV during installation. Norton Systemworks didn't find anything particularly wrong - there's always a missing sytem file, wouldn't be the same without that message!

[chiversj] 17/9/2004 07:18

Dear gala_wanderer,

Do you have a firewall installed? If so, please could you specify the brand?

Thanks,

James

[gala_wanderer] 17/9/2004 07:16

Did advfn do anything to change their setup yesterday?????

My setup had worked fine, now I'm sitting with XP, IE6, a copy of sun java and flidded around with all my IE settings, for it to remain not working.

I have Sun java installed, even the developer kit. One morning it works then the next it doesn't.

[philmiboots] 30/8/2004 22:26

Following a link from the Microsoft/Sun news link gives.............
Foundation Total Grants $7,232,409,414 since inception.
Extraordinary, always thought the software was grotesquely overpriced.

[maestro.] 30/8/2004 22:14

click on site 1 then downloads and then download all 3...works great!