



Apple Nabs Java Exploit That Bypassed Disabled Plugin 97
Trailrunner7 writes "Apple on Thursday released a large batch of security fixes for its OS X operating system, one of which patches a flaw that allowed Java Web Start applications to run even when users had Java disabled in the browser. There have been a slew of serious vulnerabilities in Java disclosed in the last few months, and security experts have been recommending that users disable Java in their various browsers as a protection mechanism. However, it appears that measure wasn't quite enough to protect users of some versions of OS X."
Re:Java and flash... (Score:5, Interesting)
So... (Score:3, Interesting)
If the Apple Safari browser on Apple OSX had Java disabled it let it run anyway? Glad they fixed that.
Such an hero.
Re:Java and flash... (Score:5, Interesting)
Re:Not a bug? (Score:4, Interesting)
It's only not a bug in that it was by design.
Basically Mac OS X has a list of "safe" files that don't bring up an "are you sure you want to open this file?" dialog after it's been downloaded. The idea is that if you download a text file, you won't get a dialog warning you that the file is insecure when you try and open it.
JNLP files were put in that list, presumably based on the assumption that Java was "secure." (Bad assumption!)
The fix was to remove them from the safe list, so now you'll get an "are you sure?" dialog from the OS itself rather than assuming Java is secure.
Re:Java and flash... (Score:4, Interesting)
E.g. you can changeroot the process and then it can't do anything.
chroot is a big help, but it doesn't preclude gaining access to memory, and if you have enough access to that then you can write files using other processes' permissions. You really need to virtualize to even claim to have a sandbox which is useful from a security standpoint. Even then it's not impossible to exploit a virtual driver and gain access to the underlying hardware indirectly.