JRE 1.4.1_03 Plugin Security Manager

Hi,
We have a signed applet that runs fine under previous versions (i.e. 1.4.1_02 and earlier) of the Plugin, but throws a java.security.AccessControlException when 1.4.1_03 is in use. Has anyone else seen this? To verify, I uninstalled all of the JRE's, reinstalled 1.4.1_03, retested and got the exception, uninstalled 1.4.1_03 and installed 1.4.1_02, retested with no exception thrown.
Any ideas?
TIA,
David

Ok, here's the stack trace (along with some additional plugin output). The basic question is why would we be getting this exception only when JRE 1.4.1_03 is installed and not with JRE 1.4.1_02?
Java(TM) Plug-in: Version 1.4.1_03
Using JRE version 1.4.1_03 Java HotSpot(TM) Client VM
User home directory = C:\Documents and Settings\tipin Proxy
c: clear console window
f: finalize objects on finalization queue
g: garbage collect
h: display this help message
l: dump classloader list
m: print memory usage
o: trigger logging
p: reload proxy configuration
q: hide console
r: reload policy configuration
s: dump system properties
t: dump thread list
v: dump thread stack
x: clear classloader cache
0-5: set trace level to <n>
applet-com.hp.ov.dynamicViews.gui.core.DynamicViewApplet.class,4,http://tshp34:7510/topology/-threadGroup]
[homeBaseView] (1-15.2.118.83-thread applet-com.hp.ov.dynamicViews.gui.core.DynamicViewApplet.class) Could not launch new Dynamic View
java.security.AccessControlException: access denied (java.util.PropertyPermission entityExpansionLimit read) at java.security.AccessControlContext.checkPermission(Unknown Source) at java.security.AccessController.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPermission(Unknown Source) at java.lang.SecurityManager.checkPropertyAccess(Unknown Source) at java.lang.System.getProperty(Unknown Source) at org.apache.crimson.parser.Parser2.init(Unknown Source) at org.apache.crimson.parser.Parser2.parse(Unknown Source) at org.apache.crimson.parser.XMLReaderImpl.parse(Unknown Source) at org.apache.crimson.jaxp.DocumentBuilderImpl.parse(Unknown Source) at com.hp.ov.ui.netgraph.utility.parser.JAXPParser.parse(Unknown Source) at com.hp.ov.ui.netgraph.utility.parser.BucketXMLParser.getRootElement(Unknown Source) at com.hp.ov.ui.netgraph.NetGraph.loadStyleXMLString(Unknown Source) at com.hp.ov.ui.netgraph.NetGraph.loadStyleXML(Unknown Source) at com.hp.ov.dynamicViews.gui.core.DynamicViewGraph.<init>(DynamicViewGraph.java:73) at com.hp.ov.dynamicViews.gui.core.DynamicViewWindow.<init>(DynamicViewWindow.java:44) at com.hp.ov.dynamicViews.gui.core.DynamicView.display(DynamicView.java:235) at com.hp.ov.dynamicViews.gui.core.DynamicView.newDynamicView(DynamicView.java:318) at com.hp.ov.dynamicViews.gui.core.ViewLauncher.actionPerformed(ViewLauncher.java:88) at javax.swing.AbstractButton.fireActionPerformed(Unknown Source) at javax.swing.AbstractButton$ForwardActionEvents.actionPerformed(Unknown Source) at javax.swing.DefaultButtonModel.fireActionPerformed(Unknown Source) at javax.swing.DefaultButtonModel.setPressed(Unknown Source) at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(Unknown Source) at java.awt.Component.processMouseEvent(Unknown Source) at java.awt.Component.processEvent(Unknown Source) at java.awt.Container.processEvent(Unknown Source) at java.awt.Component.dispatchEventImpl(Unknown Source) at java.awt.Container.dispatchEventImpl(Unknown Source) at java.awt.Component.dispatchEvent(Unknown Source) at java.awt.LightweightDispatcher.retargetMouseEvent(Unknown Source) at java.awt.LightweightDispatcher.processMouseEvent(Unknown Source) at java.awt.LightweightDispatcher.dispatchEvent(Unknown Source) at java.awt.Container.dispatchEventImpl(Unknown Source) at java.awt.Component.dispatchEvent(Unknown Source) at java.awt.EventQueue.dispatchEvent(Unknown Source) at java.awt.EventDispatchThread.pumpOneEventForHierarchy(Unknown Source) at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source) at java.awt.EventDispatchThread.pumpEvents(Unknown Source) at java.awt.EventDispatchThread.pumpEvents(Unknown Source) at java.awt.EventDispatchThread.run(Unknown Source)

Similar Messages

" plug-in name does not support the highest level of security for Safari plug-ins" appear for some plugins in Safari Security "Manage Website Settings"?

Hi,
Wondering why "<plug-in name> does not support the highest level of security for Safari plug-ins" appear for some plugins in Safari > Security > "Manage Website Settings"?
Have been trying to get to the root cause of the problem but did not find much on this. I am trying to figure out what can get the warning to go away completely than using the Allow/Always Allow options for the plug-in
Thanks,
Shyam

Hi Linc,
Thank you for your response. Here is the screenshot of the warning that I am talking about.
Here is what I do:
1. Launch Safari and open its Preferences. I have Safari 7.1 installed on my machine.
2. Click Security Tab and click Manage WebSite Settings
3. A window opens showing me all the Plug-ins that I have (listed on the left hand side).
4. One of them is the Adobe Reader plug-in. When I click Adobe Reader, the following details about the plug-in show up on the right
I was referring to the highlighted section that warns me about this plug-in not using the highest level of security for Safari Plug-ins.
Note: I do not see this for all my plug-ins (QuickTime, Adobe Flash Player don't give me this warning) which tells me that there is a way to make the warning go away.
Thanks again,
Shyam

Configuring JRE 1.4.2 plugin for TLSv1 only server

Hi,
I have apache server configured that talks only TLSv1. I wasn't able to load an applet from IE on JRE 1.4.2_05 plugin. so I did the following
1.Edited the file Documents and Settings\<<username>>\Application Data\Sun\Java\Deployment\deployment.properties file and added an entry "deployment.security.TLSv1=true"
The applet wasn't loading even then , so in JRE control panel --> Advanced tab in Java Runtime parameters , I added -Dhtps.protocols=TLSv1, It was failing again
When I tried the same on JRE 1.5 , after the step 1, I was able to load the applet, but on JRE 1.4.2 ,I am not able to load the applet for TLS only server
Please let me know , if there is any any workaround, or this is JRE bug,The error which i got on the console is
at java.net.SocketInputStream.read(Unknown Source)
at com.sun.net.ssl.internal.ssl.InputRecord.a(Unknown Source)
Thanks

I am seeing similar behaviour with JRE 1.4.2 and it appears to be a bug as it does not take the value specified in https.protocols.
You may want to try 1.5.0_05 as it has the enable TLS option in the Java Control Panel under Security.

Setting security manager

Hi,
I have a typical requirement which asks me to have a security manager which applies to only a part of the code and not to the whole code. I will try to explain it.
Lets say I have a class A which does something (may be it accesses files, open socket connections over network etc etc). This class A is a sort of trusted class and is allowed to do everything. Now suppose this class is built in such a manner that it can load another class B at runtime which could be any class written by any third party. So what exactly class B will do cannot be predicted because it is a third party class. Now what I want is to set a security manager only for class B that will prevent it to do any nasty things like accessing file system, shutting down vm etc. . Please note that class A can do all these things but class B should not be allowed to do these. If class B tries to do any of those things then security exception should be thrown.
Hope I made my point clear.
Please note that I am not talking of Applets but complete application so pls dont forward any replies which applies to applets.
Can anyone help pls........
regards.

Hey guys,
crack_it:
If you would rather dismiss the (A)pplication (P)rogramming (I)nterface then go ahead. No disrespect to the folks at O'Reilly, but reading the API is as good as hearing it from the horses mouth. If you could humour me, just test what the API says.
I can't remember if we discussed it somewhere at some point, but I am under the impression you are locking-down you application designed in a plugin-architecture.
If this is true, you simply need to specify two entries in your policy: one for your code in app_home/lib; one for third-party code in app_home/plugins. How you load these classes are irrelevant.
As for detecting which classes trigger security checks, as mmhuda says, you can access the execution stack through the Thread class. You can retrieve information on the calling class and its method which made the call. These 'calls' are stacked i.e. most recent first. You may need to skip 3 or 4 frames (StackTraceElements) which represent the calls to access the stack information. It is troublesome. I recently implemented a similar method wihtin my Policy implementation to prevent it from being wrapped and exploited by other bogus policy implementations. I have a lookup of class.method --> class.method strings that represent permitted calls. All you would need to do is implement a lookup mapping class or class.method --> Permission or Permissions (PermissionCollection) containing what the class can do, and check against them.
Now I have stated it, I am even more convinced; you are simply reimplementing the security infrastructure,or rather, shifting the function of the Policy and AccessController to your XxxxSecurityManager. Perhaps a waste of effort.
mmhuda:
Do not confuse terms; a class can be loaded and not in the execution stack - I wouldn't be surprised if a loaded class spends 99.99% of its life sitting idle off the stack. The stack represents a 'chain' of method calls for a particular Thread. It does not represent all the loaded classes in the JVM, otherwise the stack would be 100's of frames deep.
Warm regards,
D

Security manager enabled w/o -Djava.security.manager

Hi all,
I am facing an issue where java.policy is being enforced w/o a -Djava.security.manager specified on the command line.
from ps -ef | grep java, I found the java process and it does not have -Djava.security.manager. However, when I modify jdk/jre/lib/security/java.policy, I can see the effect of the security setting when I restart the java process. I scanned through the source code, I do not find any setSecurityManager() API call either.
Given the above, does anyone have suggestion on how the security manager is enabled in this case?
Regards,
Tom

System.setProperty("java.security.manager","true");
System.getProperties().setProperty("java.security.manager","true");
Properties p = System.getProperties();
p.setProperty("java.security.manager","true");
// etc

Load security manager by default?

I'm trying to improve security on Windows XP desktop machines. On the system in question, it is impossible for an ordinary user to run exe or any script files that are not located in specific directories (as per a standard software restriction policy). Unfortunately it seems that this does not apply to jar files since they are just archives which are opened with the java virtual machine. Even if specifically blocking .jar extensions worked, it is still possible to change the file extension and still run it from the command line using eg 'javaw.exe -jar file.txt'.
It seems like the java security manager would be useful to enforce this, or at least sandbox code from outside the trusted directories, but it seems that java trusts all code on the local machine regardless of where may have come from. While it is possible to specifically call the security manager per run of an application, or even include it in a shortcut or change the default action in windows to call it, it is still very easy to simply use the command line or a shortcut to get around this.
Is it possible to force the security manager to always run whenever javaw.exe loads? Alternatively, is there any other way to prevent certain java code from executing short of actually removing the JRE (which would disable certain applications and web services)?
Thanks

hello, yes you can do that - for the principle method of locking certain preferences please refer to this article: http://kb.mozillazine.org/Locking_preferences
in your case you'd have to put this line in your lockfile:
lockPref("signon.rememberSignons", false);

Need security management software for OS 8.6 through 9.2

Are there any security management softwares available these days for OS 8.6 through OS 9.2? Something which lets the computer owner turn off firewire and USB is what I'm looking for. It would be nice to be able to allow only some selected USB devices, like a keyboard and a printer or scanner, and still disallow external drives or thumb flash drives, but turning off all USB would be useful on machines which don't need USB keyboards, like beige or B&W PMG3 computers or G3 iBooks.

Are there any security management softwares available these days for OS 8.6 through OS 9.2? Something which lets the computer owner turn off firewire and USB is what I'm looking for. It would be nice to be able to allow only some selected USB devices, like a keyboard and a printer or scanner, and still disallow external drives or thumb flash drives, but turning off all USB would be useful on machines which don't need USB keyboards, like beige or B&W PMG3 computers or G3 iBooks.

Rmi with security manager not working in netbeans

Hello i'm trying to use rmi but get the error java.security.AccessControlException: access denied (java.net.SocketPermission 127.0.0.1:1099 connect,resolve) when i run it in netbeans. here is my code
public static void main(String[] args) {
        if (System.getSecurityManager() == null) {
            System.setSecurityManager(new SecurityManager());
        try {
            String name = "Compute";
            Compute engine = new ComputeEngine();
            Compute stub =
                (Compute) UnicastRemoteObject.exportObject(engine, 0);
            Registry registry = LocateRegistry.getRegistry();
            registry.rebind(name, stub);
            System.out.println("ComputeEngine bound");
        } catch (Exception e) {
            System.err.println("ComputeEngine exception:");
            e.printStackTrace();
    }It works if i don't have a security manager and it works with a security manager if i don't use netbeans to run it and use the command line. i need to use a secuirty manager because the client code is running in eclipse and it moans that there is no security manager if i run it without one
this is the error i get when running with no security manager
java.rmi.UnmarshalException: error unmarshalling return; nested exception is:
     java.lang.ClassNotFoundException: takenoteremote.Compute (no security manager: RMI class loader disabled)
Please help

I have sort of got it to work, i took out the security manager and used the code base parameter on the command line, and put my interface into a jar file. I can only get it to work though on the command line, if i run it in netbeans it doesn't find the class in the jar file it needs.
Any ideas?

Windows 2008 r2 Cluster not starting - "unable to create security manager worker queues"

Hello, following a power outage, we got a serious cluster error preventing the start of the cluster.
We are trying to interpret the only four lines the cluster.log generates :
00000330.000016cc::2014/09/26-10:44:06.348 ERR   [WTQ] bogus file creation failed, 2
00000330.000016cc::2014/09/26-10:44:06.348 ERR   [WTQ] bogus file creation failed, 2
00000330.000016cc::2014/09/26-10:44:06.348 ERR   [CS] Unable to create SecurityManager worker queues, 2
00000330.000016cc::2014/09/26-10:44:06.363 ERR   Error 6
AND if starting clussvc manually :
Got ERROR_FILE_NOT_FOUND(2)' because of 'Error while creating the Security Manag
er's Thread Pool' in
    000007fe:fd69940d( ERROR_MOD_NOT_FOUND(126) )
    00000000:001ff190( ERROR_MOD_NOT_FOUND(126) )
We suspect a DLL problem (because of mod not found), but we are unable to find the ones involved even with process monitor.
clusdb hive seems ok.
The situation is serious, can anybody help, please ?

Hi RodV,
This error usually caused by cluster service fails to open a
handle to the \NUL device, Device manager shows the device instance in error state.
Please check whether the following register value still exist, if not please backup your current registry then add the it.
HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\ROOT\LEGACY_NULL\0000\CONTROL
ActiveService REG_SZ Null
I am glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Problem with Advanced Security Manager

Hi
I am using the advanced security manager to migrate security from Essbase 7 server to Essbase 11 server. The users who are externally authenticated on essbase 7 server are under native security mode on the Essbase 11 server after security import.Does the Advanced security manager put all the users (whether they are externally authenticated or under native security mode) in native security mode after import?
Please help

Hello 831221
In version 11 "native" means that the users are stored in OpenLDAP (once Essbase was externalized).
You would only be able to create "external" users if the Shared Services have been connected to an external User Source (e.g. MSAD) prior to
importing the users.
best regards
.T

Security manager not used with JNDI ?!

Hi,
I have a simple stand-alone java app that does a JNDI lookup
and subsequent method invocation on the returned session bean.
I never explicitly install a security manager and am wondering
why there are no security problems getting the bean proxy
and any subsequent code downloads from the WebLogic server.
Seems like this would never work under under pure RMI, so
what's going on in this case?
Thanks, Garry

Hi,
According to the screenshot, it seems like compatibility problem, What's the type of your system?
In addition, you can refer to the link below to view its compatibility list.
http://gallery.technet.microsoft.com/LocalGPOmsi-Excellent-MS-2593b2eb
Roger Lu
TechNet Community Support

Saving Password for a pdf file in HP Client Security Manager

Hello,
I want to save the password for a pdf file in the Password Manager of the HP Client Security Manager Software but the symbol for the entry of the password is not appearing on the top right of the screen. If I use the registered fingerprint a dialog opens where the Client Security Manager asks which account it should use to login. But i can't add a password for the file. The login for websites is perfectly fine.
Do you have any idea how to fix that?
Is there a way to manually enter password for files?
Thanks in advance.

Thanks for the information.
Suggest you to try uninstall and re-install the latest version which is - 8.3.3.1762. The direct link is:
http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=5405363&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D%257CswItem%253Dob_129972_1%257CswEnvOID%253D4060%257CitemLocale%253D%257CswLang%253D%257Cmode%253D%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken
If this does not fix, then suggest you to log a call with technical support.
Please do post any progress on this.

Datagram socket and security manager

I have subclassed the security manager to implement my own network security rules.
However when the receive(datagramPacket) method is called by the my datagram socket, the host parameter passed to the checkAccept(host, port) method does not belong to the sender of the packet(to be received).
How then can malicious addresses be blocked by the security manager, as suggested by the comments in the source code of DatagramSocket.
Any help is greatly appreciated. Thank you in advance.

However when the receive(datagramPacket) method is
called by the my datagram socket, the host parameter
passed to the checkAccept(host, port) method does
not belong to the sender of the packet(to be
received).It should. What are you getting instead?

Security Manager/Access problem

(WWC-00000)
An unexpected error has occurred in portlet instances: wwpob_api_portlet_inst.create_inst (WWC-44846)
The following error occurred during the call to Web provider: java.lang.NullPointerException
at oracle.portal.provider.v2.security.URLSecurityManager.hasAccess(Unknown Source)
at oracle.portal.provider.v2.DefaultPortletDefinition.hasAccess(Unknown Source)
at oracle.portal.provider.v2.ProviderInstance.getPortletDefinition(Unknown Source)
at oracle.portal.provider.v2.ProviderInstance.getPortletInstance(Unknown Source)
at oracle.portal.provider.v2.ProviderInstance.getPortletInstance(Unknown Source)
at oracle.webdb.provider.v2.adapter.soapV1.ProviderAdapter.registerPortlet(Unknown Source)
at java.lang.reflect.Method.invoke(Native Method)
at oracle.webdb.provider.v2.utils.soap.SOAPProcessor.doMethodCall(Unknown Source)
at oracle.webdb.provider.v2.utils.soap.SOAPProcessor.processInternal(Unknown Source)
at oracle.webdb.provider.v2.utils.soap.SOAPProcessor.process(Unknown Source)
at oracle.webdb.provider.v2.adapter.SOAPServlet.doSOAPCall(Unknown Source)
at oracle.webdb.provider.v2.adapter.SOAPServlet.service(Unknown Source)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:336)
at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:59)
at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:283)
at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:523)
at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:269)
at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:735)
at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:151)
at com.evermind.util.ThreadPoolThread.run(ThreadPoolThread.java:64)
(WWC-43147)
Removing the provider.xml security manager setting will do away with this problem.
Versions being used: Portal 9.0.2 and PDK september.

I have checked with PDK September samples related to Security Manager/Access and they are working fine. Please lets know for which PDK sample gives this error.

Access to IPortalComponentRequest in custom security manager

Hi All,
I am implementing a custom security manager. For my requirements, I need IPortalComponentRequest object in the security manager class. Can anyone give me a clue to get the request object in security manager implementation.
Regards,
Yoga

Hi Romano,
I tried this. Its returning mysapsso2 cookie and authentication_schema cookie. But not retuning any custom cookies added to the response from any other application.
What I have tried to achieve is:
1. When a user login and authentication suceeds, I will add a custom cookie to the response.
2. Get the custom cookie added in the security manager class and do manipulations to check whether the user is authenticated.
Using the method you have suggested, I was not able to get any custom cookies added in other applications.
I tried the code using resource context(resource context obtained form IUser) as suggested in other threads,
HttpServletRequest request = (HttpServletRequest) resourceContext.getObjectValue("http://sapportals.com/xmlns/cm/httpservletrequest");
But this API returns null.
Any way to achieve?
Regards
Yoga

JRE 1.4.1_03 Plugin Security Manager

Similar Messages

Maybe you are looking for