Java/Script Alert: Cross-Platform Browser Vulnerability

Ant writes "Synopsis: Opera, Mozilla & Netscape with javascript enabled are vulnerable to remote command execution. This has been tested on Microsoft, and many many Unices. Macintosh may also be vuln. Ironically enough, IE is unaffected." Update: 06/08 23:56 GMT by H : The problem seems to be one in the Java security model itself; but the evidence seems to be that if you turn off JavaScript, you turn off the vulnerability. Update: 06/09 00:56 GMT by T : According to this followup message from Mozilla security group member Daniel Veditz, the problem is actually one that's already been fixed in Mozilla 1.3, and not a remote command execution vulnerability at all. (Thanks to reader Jared Klett and others.)

Comments

Obligatory rant

[OmniVector]

Java is NOT THE SAME THING as JavaScript.

Come on slashdot editors, it's not hard to know the difference (this is in reference to the article title).
</rant>

This seems bogus.

[pegacat]

At first blush this seems plain wrong.

There's not really enough evidence in the post to go on, but the example exploit is pure nuisence java script, which has nothing to do with java

Reference is made in the text to ancient *java* bugs, but no detail is given as to how they might be related to the current, claimed bug.

If there's more here than meets the eye I'd like to see it, but there doesn't seem to be any meat in this announcement, it seems to be just a historical retrospective and an annoying-but-not-dangerous-or-new snippet of javascript.

Am I missing something here?