Advanced

Yet another Java flaw allows “complete” bypass of security sandbox

Posted by BernardSwiss on · 5 comments
Ars Technica; By Jon Brodkin 		Mail this story
Print this story

Researchers have discovered a Java flaw that would let hackers bypass critical security measures in all recent versions of the software. The flaw was announced today by Security Explorations, the same team that recently found a security hole in Java SE 7 letting attackers take complete control of PCs. But this latest exploit affects Java SE 5, 6, and 7—the last eight years worth of Java software.

“The impact of this issue is critical—we were able to successfully exploit it and achieve a complete Java security sandbox bypass in the environment of Java SE 5, 6, and 7,” Adam Gowdiak of Security Explorations wrote, claiming the hole puts "one billion users" at risk.

Full Story

  Nav
» Read more about: Story Type: News Story, Security

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (5)

tuxchick ·
I remember when Scott McNealy boasted of Java's security, and how it was designed from the bottom up to be immune to Windows nasties. I guess that was then.
jdixon ·
Scott McNealy doesn't work there anymore.
BernardSwiss Story submitter ·
Does anyone have a handle on how these Java sandbox vulnerabilities do/don't affect java alternative plugins like IcedTea>
r_a_trip ·
how it was designed from the bottom up to be immune to Windows nasties

< snark > Windows nasties are still out of the question, since Windows doesn't run on the JVM < /snark >, but java isn't the security panacea Mr. MecNealy promised us.

Or did Oracle really bork it up that fast......
CFWhitman ·
Well, this particular flaw predates Oracle's acquisition. This doesn't mean anything for any software that's not running as a web plugin, since that's the only version of Java in a sandbox anyway (the same as pretty much all the other Java security flaws).

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post