JDK-8140197 : JRE 8u65 installer doesn't work on Windows Server
  • Type: Bug
  • Component: install
  • Sub-Component: install
  • Affected Version: 8u60,9
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS: windows_2008
  • CPU: x86
  • Submitted: 2015-10-20
  • Updated: 2016-04-19
  • Resolved: 2015-11-09
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u102Fixed 9Fixed
Sub Tasks
JDK-8143247 :  
Release Note: Installers appearing stalled on ESC configurations - Closed
Description
FULL PRODUCT VERSION :
jre-8u65-windows-i586.exe

The serial number of the digital certificate is ���12 f0 27 7e 0f 23 3b 39 f9 41 9b 06 e8 cd e3 52 ; size in bytes is 50,130,016.

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]

aka. Windows Server 2008 R2 build 7601 service pack 1

EXTRA RELEVANT SYSTEM CONFIGURATION :
Enhanced Security Configuration is in the recommended configuration, i.e., enabled for administrators, disabled for users.  I am logged in as an administrator.

A DESCRIPTION OF THE PROBLEM :
The jre-8u65-windows-i586.exe installer doesn't work on Windows 2008 R2.

The error dialog says "Content within this application coming from the website listed below is being blocked by Internet Explorer Security Configuration.  file://C:\harry\jre-8u65-windows-i586.exe"

When the dialog is dismissed, the installer hangs.



STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run jre-8u65-windows-i586.exe in an account which has Enhanced Security Configuration enabled.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
I expected to see the installer dialog.
ACTUAL -
I saw an error message about ESC, and when I dismissed it the installer hung.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Content within this application coming from the website listed below is being blocked by Internet Explorer Security Configuration.  

file://C:\harry\jre-8u65-windows-i586.exe

REPRODUCIBILITY :
This bug can be reproduced always.

CUSTOMER SUBMITTED WORKAROUND :
Silent mode works:

start /wait jre-8u65-windows-i586 /s REBOOT=0
Comments
which fix caused this regression ?
24-11-2015
Tested with 8u71 b08 Steps to Reproduce: 1) From Start menu: Administrative Tools -> Server Manager -> Configure IE ESC 2) Set settings: Admin: ON Users: ON 3) Launch IE 4) Launch JRE from network drive NOT local drive JRE installed successfully and no error message was given to the user.
17-11-2015
SQE ok with critical request
09-11-2015
CPU16_01-critical-request justification: - Fix for Release : 8u71 - Justification : Regression filed in Oct CPU. Loss of service (installer hang) on 2008 Server platform - Risk Analysis : Medium, new namespace implementation provisioned for internet security mgr - Webrev : https://java.se.oracle.com/code/cru/CR-JDK9CLIENT-1472 - Testing (done/to-be-done) : 9, 8u PITs/8u Promotion - Back ports (done/to-be-done) : 9/8u71 - FX Impact : NA
09-11-2015
Looks like the issue affect only a case when installer is run from network location and the location is not configured to be "trusted site" or intranet zone. In the case IE considers the location as "internet" and IE ESC disables script execution. In the original report the path is file://C:\harry\jre-8u65-windows-i586.exe, I was able to reproduce the case by using junction point: mklink /D "c:\local\dir" "k:\upload\dir" (k is a network drive)
23-10-2015
Updated affectedversion and introduced in release as per comment above.
22-10-2015
This is regression (introduced in 8u60 with new UI) But some dialogs (remove out-of-date JREs) which use new UI were introduced earlier (8u20 ?)
22-10-2015
Is it regression?
22-10-2015
No, I still cannot set up an environment (get 2008 R2 VM), but I found technical info about the issue: https://msdn.microsoft.com/en-us/library/ms537182%28v=vs.85%29.aspx That's unclear for me why Internet Explorer Security Configuration blocks local file (and looks SQE also don't see the behavior), I suppose this depends on IE Security Configuration config
22-10-2015
Alex, are you able to reproduce the problem?
22-10-2015
I have retested using correct OS, Windows Server 2008 R2. I am testing using 8u65 b17: http://jre.us.oracle.com/java/re/jdk/1.8.0_65/promoted/all/b17/bundles/windows-i586/jre-8u65-fcs-bin-b17-windows-i586-06_oct_2015.exe Tested with two security scenarios: 1) Admin: ON Users: ON 2) Admin: ON Users: OFF In both scenarios, JRE installed successfully and no error message was given to the user. Screenshot provided of the jre Welcome dialog. The FIRST time I installed the JRE, after JRE installed successfully and the verify page popped up, IE gave a warning dialog that "java.com" that the content is blocked since it is not a trusted site. (see screenshot) After I added "java.com" to the trusted site list, the page loaded however the verify java version section remained blank. (see screenshot) The SECOND time I installed the JRE, after JRE installed successfully and the verify page popped up, the verify page popped up with IE warning dialog. The "Verify java version" worked as expected.
21-10-2015
looks like htmlUI has to implement custom security manager to work with IE Security Configuration
21-10-2015
Please ref: http://serverfault.com/questions/730376/how-can-i-install-java-8u65-on-a-windows-server
21-10-2015
I saw no error messages when I installed the JRE. JRE installed successfully without any issues.
21-10-2015
And did you see mentioned "Content within this application coming from the website listed below is being blocked by Internet Explorer Security Configuration" error dialog?
21-10-2015
Guys (SQE), the OS should be 2008 R2 (server version of Windows 7), not 2008 (server version of Vista)
21-10-2015
So the issue cannot be repo'd by several Install Dev members and SQE members. I think this is a special case where the user has security settings that we do not. Can we close this as "cannot repo"?
21-10-2015
I could not reproduce this issue. Tested using 8u65 b17: http://jre.us.oracle.com/java/re/jdk/1.8.0_65/promoted/all/b17/bundles/windows-i586/jre-8u65-fcs-bin-b17-windows-i586-06_oct_2015.exe Enhanced security settings enabled as instructed in the bug. I tried two scenarios for the security: 1) Admin On, Users On 2) Admin On, Users Off I was able to install the JRE successfully and did not see an error dialog in both scenarios. Provided two screenshots attached after successful JRE installation. OS used: Windows Server 2008 Standard Edition build 6001 SP1
21-10-2015
Mark, Randy, can you please have someone to reproduce the issue and figure out whether it is regression?
21-10-2015
Silent mode is ok. Is there some kind of session isolation with the container we use for the html/js UE?
21-10-2015