Cross-Platform Java Sandbox Exploit

DrWho520 points out this report at silicon.com which begins "A flaw in Sun's plug-in for running Java on a variety of browsers and operating systems could allow a virus to spread through Microsoft Windows and Linux PCs. The vulnerability, found by Finnish security researcher Jouko Pynnonen in June, was patched last month by Sun, but its details were not made public until Tuesday." The hole affects Linux and Windows.

Comments

Re:Windows and Linux?

[rdc_uk]

What the article says is that the same exploit (same hole in the Java Runtime Engine's security) allows access to multiple OSes (through multiple browsers)

So; johnny hacker writes his Java exploit; part of which decides what OS it is currently fiddling with, then has it deposit an appropriate payload for the OS.

Voila; spreads through Windows and Linux.

Write once, run anywhere :)

Java finally reaches its full potential

[scatter_gather]

Write once, exploit everywhere!
:)

Write once, infect everywhere!

[dangermen]

Write once, infect everywhere!

Linux!?! Nooo

[NitsujTPU]

Linux?

No, no, it can't be? Linux is invulnerable to virii!

Java == Java Sandbox... ohpps!

[Ghoser777]

You were comparing references (memory addresses) instead of actual values. I think you should have used:

Java.equals(JavaSandbox)

instead. It's a common mistake, don't sweat it.