emet and java

anyone knows how to configure EMET with java so it gives protection but won't crash the update process?

thanks

 

Read this:

http://social.technet.microsoft.com/Forums/en-US/emet/thread/0748f3f6-a2b7-4b58-b37a-414a1b0d516e


http://rationallyparanoid.com/articles/microsoft-emet-2.html

 

already did that. i added those files and removed DEP on them.. still doesnt work.

@edit: okay it seems like smth else is causing the troubles.. i removed all java files from emet and still its not working :S

"failed to download required installation files"

 

Then I don't what you can do, I use Secunia PSI to keep the important apps update.

 

thanks.. with secunia psi it works fine

 

This has been my experience with Java and EMET.

With DEP set to Always On, I always could update Java. But, be aware that there are two Java installers.

There's an installer that's simply a patch, and contains no *.msi file. And, then there's the installer.

The names are differentiated by an s.

Example name for the patch jre-6u26-windows-i586-s.exe
Example name for the installer jre-6u26-windows-i586.exe

The first one, you get from java.com and the second one from here -http://www.oracle.com/technetwork/java/javase/downloads/jre-6u26-download-400751.html

I never had issues with the second one. Even recently I installed Java (the second link) in a relative's system with EMET and DEP set to Always on.


-edit-

For future reference, you could bookmark this URL -http://www.oracle.com/technetwork/java/javase/downloads/index.html (The one to download is JRE version.)

 

By the way, even without EMET, the update process (Java's internal updater) never worked properly. It would never update. So, I manually update.

 

I have them all forced with EMET. I just use Filehippo for updates.

 

and what kind of files did you add to emet (java) ?

i have:

java.exe (program files/java/jre6/bin)
java.exe (syswow64)
javaw.exe (program files/java/jre6/bin)
javaw.exe (syswow64)
javaws.exe (program files/java/jre6/bin)
javaws.exe (syswow64)
jp2launcher.exe (program files/java/jre6/bin)
jqs.exe (program files/java/jre6/bin)
jusched,exe (common files/java/java update/...)

all checkboxes are checked.

 

I have the same experience. Can't install/update java through manual or automatic update.
So to install/java java I turn off all emet protection (DEP SEHOP and ASLR)

But I've read somewhere in this forum that you can also choose "opt in" for DEP and SEHOP , ASLR to work it out.

@zakazak : my choice for java are copied from : -http://rationallyparanoid.com/articles/microsoft-emet-2.html

Next time I won't be installing java to real machine so I don't have to set all this mess just to avoid being exploited

 

Easiest way (and far more secure than Opt In) is to make DEP Opt Out.

@zakazak: More than enough, I didn't bother adding jusched.exe though (that's the update scheduler by the way).

 

Thx for the info