Java 7 updates are installing to default directory.

Products

• Patch Management Solution for Windows

Issue/Introduction

Deployed Java7_72 via Patch Management and the alternative install directory remained intact from initial install. However, when running the Java7_75 installer via Patch Management Solution; it removed the JRE from the alternative install directory, and installed it to a default: C:\Program Files (x86)\Java\jre1.7.0_75

Reviewed the .bat file used to execute the Java7_75 update: Confirmed that the change in install location behavior is because of changes in the .bat file. In the stock jre-7u75--windows-i586.bat. Line 35. The install command uses STATIC=1

Reviewed the .bat file for previous versions of the installer: Found they don't use a static install switch of 'STATIC=1'

This proves that the changes in the .bat file deployment logic is what is causing the default directory targeted install.

Environment

Patch Management 7.5.x, 7.6.x & 8.0.x

Cause

This is a result of recent changes in the Java Installer logic. The method of installing a Java update in place necessarily involves the uninstall of the old version followed by the install of the new version in the same location.  

This is problematic because Oracle's installer cannot properly handle the uninstall of the old version of Java in an automated manner when Java is in use.  The end result in such cases is that the uninstall of the old version hangs and fails to complete.  The new version does not get installed.  The end user is left with a non-functional version of Java.

In order to avoid this problem, the Patch Management Solution now performs static installations of Java updates.  The new version gets installed alongside the old version.  The old version gets uninstalled after the system reboot and confirmation of the new version install being successful.  

This eliminates the problem of the uninstall of the old version failing because it is in use, thereby preventing situations in which the old version of Java is left in a non-functional state and the new version does not get installed.  In addition, the new version becomes the default version which eliminates the security holes associated with the old version.

Advisory: This has been an ongoing concern since deployment PM 7.1 SP1 release, and is detailed in KM: TECH217703, but these recent findings regarding 'STATIC=1' basically forces the default directory update installation as the process runs a 'side-by-side' installation ensuring that the version being updated is not uninstalled until the new updated version is isntalled successfully. 

Resolution

This matter has been discussed in detail by the Product Management and Engineering Team, and Symantec Inc. is unable to undo the recent changes in order to support in-place upgrades of Java for the reasons documented under the Cause section above.

This is the method of installation moving forward until Oracle is able to modify the Java Installer Logic to uninstall previous versions of Java in an automated way that doesn't result in the possibilty of the end user being left with a non-functional version of Java.

Workaround:

1. Modify any dependent software applications to add variable detection for Java install directory.
   • Note: The changes made to the installer by Oracle include Java 7_71 and up would be made in the deployment .bat file.