Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

So, Apple has again updated their XProtect malware definitions to block Java Applets. Unfortunately, my wife's employer's VPN requires an Applet to be run in order to fully establish connectivity. She woke up this morning to discover she couldn't connect to work.

I have little hope that her employer's IT organization will do anything to resolve this anytime soon, so I'm trying to figure out a way to override XProtect and re-enable Applets. Yes, I understand the dangers associated with such.

I haven't yet tried updating the XProtect.meta.plist file to change the version information, but I suspect that wouldn't be a durable fix even if it did work temporarily, as the XProtect daemon would presumably re-download updated definitions.

Anybody knowledgeable on the inner workings of XProtect?

The computer is still on Snow Leopard, running Java 6.

share|improve this question
    
FWIW, you should then manually disable Java in all your browsers except one, which you use only for the VPN. The Java exploits are bad news; all you have do is show up at an infected site and your computer is pwned. –  Reid Feb 5 '13 at 18:09
add comment

2 Answers 2

up vote 6 down vote accepted

You can disable the XProtect updates in System Preferences => Security => General, and there uncheck the box "Automatically update safe downloads list."

Now you can change the version info in /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

share|improve this answer
3  
Just checked on 10.8.2 and it’s in System Preferences => Security => General => Advanced…. Need to unlock the panel & click that in the lower right-hand corner. –  JakeGould Feb 1 '13 at 4:20
    
This is great, I have had the same issue and have not been able to VPN to work. –  bluefeet Feb 1 '13 at 11:16
add comment

Just got bitten by this & there is another way to re-enable Java that is outlined here.

So the deal is Apple will not load Java less than version 1.6.0_37-b06-435 or 1.7.11.22. So the hacky—but usable—solution is to edit the XProtect.meta.plist. Using my 10.6.8 install using Java 1.6.0_37-b06-434 as an example.

sudo nano /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

Find this line:

<string>1.6.0_37-b06-435</string>

And change it to this:

<string>1.6.0_37-b06-434</string>

Was able to do this & have loaded a Java page with a plug-in without issue.

Why does Apple set the expiration to January 31, 2013 but doesn’t release an update prior to that date is beyond me.

share|improve this answer
    
Thanks for the link. I've selected the other as the answer mostly because he got there first! –  Aron Feb 1 '13 at 2:10
1  
The answer as to why this is done cold be that all current versions of java plug are vulnerable to exploitation and not secure. That is the point of Xprotect. If you don't want known unsafe programs disabled automatically, you can disable that feature. –  bmike Feb 4 '13 at 13:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.