Disabled Java Plugins, XProtect Updater

Today Apple updated the XProtect.meta.plist file, which, among other things, causes XProtect to disable Java Plugins that don’t meet a minimum version.

The net effect was to disable the Java 6 plugin on all browsers, as well as Java 7 plugins older than 1.7.11.22.

If you need to continue to use the Java 6 plugin in your organization, you can revert the changes and disable the mechanism that updates the XProtect.meta.plist by installing this package:

https://dl.dropbox.com/u/8119814/DisableXProtectUpdater.pkg.zip

This is a payload-free package that runs this script as a postflight:

#!/bin/sh

# don't check JavaWebComponentVersionMinimum
XPROTECT_META_PLIST="$3/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist"
/usr/libexec/PlistBuddy -c "Delete :JavaWebComponentVersionMinimum" "$XPROTECT_META_PLIST"

# disable the xprotectupdater job
LAUNCHD_JOB_PLIST="$3/System/Library/LaunchDaemons/com.apple.xprotectupdater.plist"
/bin/launchctl unload -w "$LAUNCHD_JOB_PLIST"

I won’t tell you this is a smart thing to install; there are many reasons to leave things as they are. Apple disabled these plugins to protect from known exploits. By re-enabling them, you are opening up your managed machines to these exploits.

But if your org needs the Java 6 Web Plugin, this should get you running again. You should re-enable the XProtect updater as soon as you are able, though:

sudo /bin/launchctl load -w /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist

NOTE: if you need to re-enable an older version of the Oracle Java 1.7 Plugin, you’ll need to edit the postflight script and add something like:

/usr/libexec/PlistBuddy -c "Set  lugInBlacklist:10:com.oracle.java.JavaAppletPlugin:MinimumPlugInBundleVersion 1.7.10.19" "$XPROTECT_META_PLIST"

(Sadly, WordPress changes a colon followed by a P into a emoticon, even in pre-formatted text. Not helping…)

This sets the MinimumPlugInBundleVersion for the Oracle Java Web Plugin back to the value it was with the 10 Jan 2013 version of the XProtect.meta.plist. Again, if you do this, you are choosing to expose your machines to a known Java Web Plugin exploit. Do so at your own risk.

(Update 01 Feb 21013)
If you need to run the Oracle Java 1.7 Plugin (or are already running it and it’s been disabled) the best fix is to update the Java install. As of this writing, Java 7 Release 13 for OS X is available here. This installs a web plugin with BundleVersion 1.7.13.20.

(Update 02 Feb 2103)
Apple has released a Java 6 update for Snow Leopard. Installing this update will restore Java 6 web plugin functionality under Mac OS 10.6. This won’t help if you need to use the Java 6 web plugin under OS X 10.7 or later.

Adobe reserialization tool

Here’s the tool I promised earlier:

https://github.com/gregneagle/makereserializationpkg

Enjoy.

Fix for Adobe CS6 activation issue

Adobe has posted some information and a fix for the recent issue with Adobe Photoshop CS6 registration/activations:

http://blogs.adobe.com/oobe/2013/01/32767-days-left-but-whos-counting.html

This issue appears to have been triggered by the Photoshop CS6 13.0.2 and/or 13.0.3 updates. The official recommendation on a fix is to update Photoshop CS6 to 13.0.4, then use the APTEE tool to remove and reapply serialization. See the above post for more details.

The APTEE tool is not exactly easy to use to deploy this fix in an enterprise environment; you need to install it on all your machines and also run a script (which you must write, test, and debug) on all your machines to perform the unserialization/reserialization.

Later today I will post a tool to help you create a standard Apple package to perform these steps. If you have some way to distribute and install Apple packages on your machines, you’ll be able to do the unserialization/reserialization by installing a package.

Check back later!

Adobe CS6 Serialization problem links

Here are some links related to the Adobe CS6 Serialization issue:

http://forums.adobe.com/message/4979720

https://twitter.com/Adobe_ITToolkit

http://work.mikeboylan.com/adobe-cs6-serialization-fun-er-hell

https://jamfnation.jamfsoftware.com/discussion.html?id=6275

https://jamfnation.jamfsoftware.com/discussion.html?id=6289

Adobe CS6 Serialization fun

Recently (starting some time after the first of the year), we’ve started having users call and tell us that their formerly working install of Adobe Photoshop CS6 was now asking for a sign-in:

We could not figure out why this was happening. An uninstall and reinstall of our AAMEE3-generated installation package seemed to get things working. But then the same users would call back the next day with the same issue.

Still more on Flash Installers

A follow up from today’s earlier post: some commenters mention that the disk image they downloaded contains a package like “normal”.

I’ve found at least five versions of the 11.5.502.146 installer:

All of these were downloaded today. Which version you get seems to depend on which browser you use!

Safari may lead you to one (if you decline the suggestion to also install Chrome you get a different one); Chrome returns another, and Firefox returns still another! And if you register to redistribute Flash and use the special URL you are given if/when you are approved for redistribution, you get yet another version.

And yet none of these are simply Apple packages. Sigh. They are either disk images that contain an application that contains a package, or disk images that contain an application that downloads another disk image that contains an application that contains a package.

On a related note, I recently watched Inception.

New Year, New Flash Post

Today Adobe released yet another Flash update. If you need to deploy it in an enterprise environment and head to http://get2.adobe.com/flashplayer/ to grab it, you might be surprised that what you download no longer includes an Apple package, and if you aren’t careful, the thing you download will try to install Google Chrome as well.

If you want the previous installer format, which was a disk image containing an application that contained an Apple package, you can still get it.

If you have not yet, you need to sign up to redistribute Adobe Flash here. Once you are approved, you’ll get a special link to download versions of the Flash installer that act like the previous ones.

At least for now.