Java blocked in Safari on 10.6.x – 10.8.x

As of January 31st, it appears that Apple has blocked both Java 6 and Java 7 Update 11 from running in Safari.

---

Update 1 – February 1, 2013: Oracle has released Java 7 Update 13 to address the vulnerabilities in Java 7 Update 11. Once Java 7 Update 13 has been installed, Safari will no longer block the Java plug-in on 10.7.x – 10.8.x.

---

---

Update 2 – February 1, 2013: Apple has released Java for Mac OS X 10.6 Update 12 to address the vulnerabilities in Java 6 on 10.6.x Macs. Once Java for Mac OS X 10.6 Update 12 has been installed via Apple’s Software Update, Safari will no longer block the Java plug-in on 10.6.x.

---

To verify this on your own machine:

1. Open Safari on a Mac running 10.6.x or higher.

2. Go to http://www.java.com/en/download/testjava.jsp to test your Java browser plug-in.

Instead of a report that Java is working, you’ll receive a Blocked Plug-In message.

The best workaround at this time is to use Firefox. I tested with Firefox 18 and Firefox is not blocking the Java plug-in at this time.

Current Status:

Java 6 on 10.6.x: Apple has released Java for Mac OS X 10.6 Update 12 to address the vulnerabilities in Java 6 on 10.6.x Macs. Once Java for Mac OS X 10.6 Update 12 has been installed via Apple’s Software Update, Safari will no longer block the Java plug-in on 10.6.x.

Java 7 on 10.7.x and 10.8.x: Oracle has released Java 7 Update 13 to address the vulnerabilities in Java 7 Update 11. Once Java 7 Update 13 has been installed, Safari will no longer block the Java plug-in on 10.7.x – 10.8.x

The blocking was done by Apple’s built-in malware protection. For those interested, the list of acceptable browser plug-in versions is stored at /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta.plist

As of 7:07 AM on Thursday, January 31st, XProtect.meta.plist on my 10.8.2 laptop had the following contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>JavaWebComponentVersionMinimum</key>
	<string>1.6.0_37-b06-435</string>
	<key>LastModification</key>
	<string>Thu, 31 Jan 2013 04:41:14 GMT</string>
	<key>PlugInBlacklist</key>
	<dict>
		<key>10</key>
		<dict>
			<key>com.macromedia.Flash Player.plugin</key>
			<dict>
				<key>MinimumPlugInBundleVersion</key>
				<string>11.3.300.271</string>
			</dict>
			<key>com.oracle.java.JavaAppletPlugin</key>
			<dict>
				<key>MinimumPlugInBundleVersion</key>
				<string>1.7.11.22</string>
			</dict>
		</dict>
	</dict>
	<key>Version</key>
	<integer>2028</integer>
</dict>
</plist>

Java 6 plug-in
The plugin version installed by Apple is 1.6.0_37-b06-434. The plug-in blacklist is specifying that 1.6.0_37-b06-435 or higher is required, so 1.6.0_37-b06-434 is being blocked automatically.

Java 7 plug-in
The plugin version installed by the current Oracle Java 7 Update 11 installer is 1.7.11.21. The plug-in blacklist is specifying that 1.7.11.22 or higher is required, so 1.7.11.21 is being blocked automatically.