787136 - Update pluginfinder to support JRE 1.7.0.7

Status: VERIFIED FIXED

(Toolkit Graveyard :: Plugin Finder Service, defect)

Description

[Yvan Boily [:ygjb][:yvan]]

Oracle has release a patch for the recent vulns out of band, and I have confirmed that at least the exploit in metasploit no longer works, and others are reporting it as verified fixed on twitter.

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

Release notes link if needed - http://www.oracle.com/technetwork/java/javase/7u7-relnotes-1835816.html

Comment 2

[Fred Wenzel [:wenzel]]

CCing Laura, whose team provides technical assistance for PFS. Carsten is already CCed.

Comment 3

[Laura Thomson :laura]

We need the SHA1 hash for the installer.  (See https://bugzilla.mozilla.org/show_bug.cgi?id=759116#c0 for an example)

Comment 4

[Laura Thomson :laura]

mcoates provided the hash, and clouserw was kind enough to land it:
https://github.com/mozilla/zamboni/commit/91ccef745c92548d885522b4f700f40528635f2c

Thanks Wil!

Comment 5

[raymond [:retornam] (inactive)]

stage still has 1.7.0.6 as up to date http://screencast.com/t/C0Nfv1w1d

Comment 6

[Laura Thomson :laura]

ccing clouserw for comment - did we miss something?

Comment 7

[Matthew N. [:MattN]]

The patch in comment 4 was for the plugin finder service which is what the bug summary is about.  Bug 787217 is for plugincheck.

Comment 8

[Michael Coates [:mcoates] (acct no longer active)]

Just talked with MattN on irc.  This is a two step process:

Step 1 - Update plugin finder service. That is this bug and is done

Step 2 - Log into https://plugins.mozilla.org/en-us/login and update the Java entry https://plugins.mozilla.org/en-us/plugins/detail/java-runtime-environment This is not yet done and is captured in bug 787217. Tomcat or key will do this and they are copied in that bug.

Comment 9

[Carsten Book [:Tomcat]]

(In reply to Michael Coates [:mcoates] from comment #8)

> Step 2 - Log into https://plugins.mozilla.org/en-us/login and update the
> Java entry
> https://plugins.mozilla.org/en-us/plugins/detail/java-runtime-environment
> This is not yet done and is captured in bug 787217. Tomcat or key will do
> this and they are copied in that bug.

kev did this point last night and should be updated now for all users

Comment 10

[u279076]

Something I noticed when testing the staged block:
 * Java 7u6 reports in PFS as "out of date" (yellow)
 * Java 7u5 reports in PFS as "vulnerable" (red)

I think we'd want to communicate both as vulnerable.

Comment 11

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to Anthony Hughes, Mozilla QA (:ashughes) from comment #10)
> Something I noticed when testing the staged block:
>  * Java 7u6 reports in PFS as "out of date" (yellow)
>  * Java 7u5 reports in PFS as "vulnerable" (red)
> 
> I think we'd want to communicate both as vulnerable.

reopened to address comment 10

Comment 12

[Laura Thomson :laura]

Wrong bug.  You need to reopen bug 787217 to get that changed.

Comment 13

[Matthew N. [:MattN]]

Copying comment 10 and comment 11 to bug 787217.

Comment 14

[u279076]

This appears to be working good now. Marking verified fixed.