Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as substitute Oracle Forms clients. JInitiator is an old JRE version put out by Oracle to get around bugs in early versions of the Java browser plugins. Oracle ended support for it in 2008 and advises against using it.

We keep patching the JRE on the desktop and this disrupts business each time because it blows away required dlls that currently live in the JRE/bin folder. We have a ready solution to this problem: Oracle forms server can be configured to drop the dlls in another folder.

I wanted confirm my thoughts about JInitiator: It is an ancient version of the Java browser plugin that probably has many of the same flaws as the current Java browser plugins. Just because there aren't any CVEs on it doesn't mean it is safe. If it got the same attention the Java plugin is getting it wouldn't stand up.

Thank you for your attention whether you back me up or not.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

JInitiator is based on Sun (now Oracle) JVM implementation, so it is a safe bet that every single vulnerability which was in Sun/Oracle JVM before 2008 (when the last JInitiator version was produced) but discovered only afterwards applies to JInitiator. Lack of CVE only comes from disinterest on the part of people who fill CVE (there is no glory in pointing out security flaws in a product which has been discontinued five years ago).

Note that some vulnerabilities are novelties, e.g. the one described on this page uses a feature introduced with Java 7 -- it would not work on JInitiator. You may want to go through this list: vulnerabilities which were discovered after 2008, but impact JRE 1.3 and later, have a high probability of impacting JInitiator as well. You only need to find one working exploit demo to have a convincing case that JInitiator should be rolled out ASAP.

share|improve this answer
2  
and by "rolled out" you mean out the door, right? –  mcgyver5 Mar 20 '13 at 14:06
1  
1) find obsolete products 2) create CVEs 3) profit –  mcgyver5 Mar 20 '13 at 14:30
add comment

Yes, as @Tom Leek said, migrate away from JInitiator, it is worse than the alternatives and old jre exploits should work against it.

BUT:

The news just gets worse from here.

Oracle Forms is only certified for running on 1.6 JRE, which is now not getting updates.

And sometimes JRE 1.7 updates can blow away any 1.6 installs (current advice from Oracle is to turn off automatic updates of Java on unmanaged windows).

So, you have just gone down the rabbit-hole, and the developer of java and the developer of Oracle Forms are making conflicting decisions (of course they are both Oracle corp).

Welcome to my world.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.