2.11 Java 6 is not the default Java runtime

Information

Apple had made Java part of the core Operating System for OS X. Apple is no longer providing Java updates for OS X and updated JREs and JDK are made available by Oracle. The latest version of Java 6 made available by Apple has many unpatched vulnerabilities and should not be the default runtime for Java applets that request one from the Operating System Java is one of the most exploited environments and is no longer maintained by Apple, old versions may still be installed and should be removed from the computer or not be in the default path.

Solution

Java 6 can be removed completely or, if necessary Java applications will only work with Java 6, a custom path can be used. Impact: Old applications may rely on either an Apple supplied version of Java 6 or an updated JDK.

See Also

https://workbench.cisecurity.org/files/299

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-8a.

Plugin: Unix

Control ID: a16b4380a819d27bf4c8ab2a6e05ea7a9515e194b33275e024cf2c5acf988874