9

So, Apple has again updated their XProtect malware definitions to block Java Applets. Unfortunately, my wife's employer's VPN requires an Applet to be run in order to fully establish connectivity. She woke up this morning to discover she couldn't connect to work.

I have little hope that her employer's IT organization will do anything to resolve this anytime soon, so I'm trying to figure out a way to override XProtect and re-enable Applets. Yes, I understand the dangers associated with such.

I haven't yet tried updating the XProtect.meta.plist file to change the version information, but I suspect that wouldn't be a durable fix even if it did work temporarily, as the XProtect daemon would presumably re-download updated definitions.

Anybody knowledgeable on the inner workings of XProtect?

The computer is still on Snow Leopard, running Java 6.

Improve this question
1
  • FWIW, you should then manually disable Java in all your browsers except one, which you use only for the VPN. The Java exploits are bad news; all you have do is show up at an infected site and your computer is pwned.
    – Reid
    Feb 5, 2013 at 18:09

2 Answers 2

Reset to default
6

You can disable the XProtect updates in System Preferences => Security => General, and there uncheck the box "Automatically update safe downloads list."

Now you can change the version info in /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

Improve this answer
1
  • This is great, I have had the same issue and have not been able to VPN to work.
    – Taryn
    Feb 1, 2013 at 11:16
2

Just got bitten by this & there is another way to re-enable Java that is outlined here.

So the deal is Apple will not load Java less than version 1.6.0_37-b06-435 or 1.7.11.22. So the hacky—but usable—solution is to edit the XProtect.meta.plist. Using my 10.6.8 install using Java 1.6.0_37-b06-434 as an example.

sudo nano /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

Find this line:

<string>1.6.0_37-b06-435</string>

And change it to this:

<string>1.6.0_37-b06-434</string>

Was able to do this & have loaded a Java page with a plug-in without issue.

Why does Apple set the expiration to January 31, 2013 but doesn’t release an update prior to that date is beyond me.

Improve this answer
2
  • Thanks for the link. I've selected the other as the answer mostly because he got there first!
    – Aron
    Feb 1, 2013 at 2:10
  • 1
    The answer as to why this is done cold be that all current versions of java plug are vulnerable to exploitation and not secure. That is the point of Xprotect. If you don't want known unsafe programs disabled automatically, you can disable that feature.
    – bmike ♦
    Feb 4, 2013 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .