java updating

[CharlesT]

I have a question about when you update java a friend asked me and I want to make sure I inform them correctly on, I know that its best to remove java though add/remove programs them run the javaRa and then search for older versions of the folders before installing a new version , but,,,,, say you didnt and just updated java though the control panel where the java folder is located on windows XP and if the old version remained in the add/remove programs that was all you did delete , you still would have the new version installed in the add/remove programs , but maybe old pieces of old version left behind , would those old pieces left behind be like security leaks which could be exploited by some evil doer or is that highly unlikely ?

So if it can be exploited then ever time java updates does one have to go though that process everytime?

,, by deleting old version in add/remove programs?

and running javaRa?

and then searching for leftover folders to delete?

and if so why doesn't Sun, correct this about java so it doesn't take as mant processes?

Thanks again for all your help and advice in advance ,Have a Happy rest of weekend

[YoKenny1]

Charles, I rely on Secunia Online Software Inspector to to scan your PC for the most common programs and vulnerabilities:

http://secunia.com/vulnerability_scanning/online

Old Sun Java installations are notorious for leaving vulnerable code on the systems and that is why JavaRa was produced.

The current version of Sun Java is Version 6 Update 12 and they have committed that all future updates will remove older updates:

http://www.java.com/en/download/index.jsp

[CharlesT]

@ YoKenny1

Thanks very much for that information and links(secunia,java), thats a relief also knowing that new releases will remove older versions

[AdvancedSetup]

New versions - that started in version 6 build 10 but it only applies forward, meaning that it won't remove 6build7 and before.

In theory as long as no code was live running under system account the old code would not be dangerous, so it would need to be checked and verified that no old code was in memory with rights to update or take action on the OS.

[CharlesT]

Thanks also ....I was wondering when the builds started removing all the old builds at , you answered that , as well as the stuff about old code being active or not ...if NOT removed ,as if you just updated over a version without removing prior java, example upgraded over java 1 _ 4 a java version way back in 2004 i think that was it that is on their restore patition (could be mistaken on actual buil but its old )

[exile360]

You might also have a look at this: JavaRa It's a handy little tool that can be used to remove leftovers from previous Java installations.