emet and java

[zakazak]

anyone knows how to configure EMET with java so it gives protection but won't crash the update process?

thanks

[lordraiden]

Read this:

http://social.technet.microsoft.com/...a-414a1b0d516e


http://rationallyparanoid.com/articl...ft-emet-2.html

Sun Java JRE SE 6 C:\Program Files\Java\jre6\bin\java.exe
Sun Java JRE SE 6 C:\WINDOWS\system32\java.exe

[zakazak]

already did that. i added those files and removed DEP on them.. still doesnt work.

@edit: okay it seems like smth else is causing the troubles.. i removed all java files from emet and still its not working :S

"failed to download required installation files"

[lordraiden]

Originally Posted by zakazak

already did that. i added those files and removed DEP on them.. still doesnt work.

Then I don't what you can do, I use Secunia PSI to keep the important apps update.

[zakazak]

thanks.. with secunia psi it works fine

[m00nbl00d]

This has been my experience with Java and EMET.

With DEP set to Always On, I always could update Java. But, be aware that there are two Java installers.

There's an installer that's simply a patch, and contains no *.msi file. And, then there's the installer.

The names are differentiated by an s.

Example name for the patch jre-6u26-windows-i586-s.exe
Example name for the installer jre-6u26-windows-i586.exe

The first one, you get from java.com and the second one from here -http://www.oracle.com/technetwork/java/javase/downloads/jre-6u26-download-400751.html

I never had issues with the second one. Even recently I installed Java (the second link) in a relative's system with EMET and DEP set to Always on.


-edit-

For future reference, you could bookmark this URL -http://www.oracle.com/technetwork/java/javase/downloads/index.html (The one to download is JRE version.)

[m00nbl00d]

By the way, even without EMET, the update process (Java's internal updater) never worked properly. It would never update. So, I manually update.

[Hungry Man]

I have them all forced with EMET. I just use Filehippo for updates.

[zakazak]

and what kind of files did you add to emet (java) ?

i have:

java.exe (program files/java/jre6/bin)
java.exe (syswow64)
javaw.exe (program files/java/jre6/bin)
javaw.exe (syswow64)
javaws.exe (program files/java/jre6/bin)
javaws.exe (syswow64)
jp2launcher.exe (program files/java/jre6/bin)
jqs.exe (program files/java/jre6/bin)
jusched,exe (common files/java/java update/...)

all checkboxes are checked.

[blasev]

I have the same experience. Can't install/update java through manual or automatic update.
So to install/java java I turn off all emet protection (DEP SEHOP and ASLR)

But I've read somewhere in this forum that you can also choose "opt in" for DEP and SEHOP , ASLR to work it out.

@zakazak : my choice for java are copied from : -http://rationallyparanoid.com/articles/microsoft-emet-2.html

Next time I won't be installing java to real machine so I don't have to set all this mess just to avoid being exploited

[J_L]

Easiest way (and far more secure than Opt In) is to make DEP Opt Out.

@zakazak: More than enough, I didn't bother adding jusched.exe though (that's the update scheduler by the way).

[blasev]

Originally Posted by J_L

Easiest way (and far more secure than Opt In) is to make DEP Opt Out.

@zakazak: More than enough, I don't bother ading jusched.exe (that's the update scheduler by the way)

Thx for the info