Java flaw could lead to Windows, Linux attacks

TalkBack 15 of 91:

Next »

« Previous

• Thread View
• Flat View

Are you sure?

Not trying to be argumentave, just asking if you're sure? The anouncement referenced in the article doesn't say anything about whether the Java plug-in runs under the user or system privelages. It does however say-

"An attacker can't do much with the utility class in this example, but could use other private classes to exploit the vulnerability. Some of them allow e.g. direct access to memory or methods for modifying private fields of Java objects. The latter allows an attacker to simply turn off the Java security manager, after which there is no sandbox restricting what the Applet can do."

Which sounds to me like the machine could be wide open no matter the permissions of the user running the browser. But, I could be wrong.

Posted by: PA-ITGuy   Posted on: 11/23/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now