Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently saw this announcement on the H blog about a big hole in Java, but I can't seem to get anyone to think it's a big deal. The fact that I can visit a web site and it runs calc.exe on my local box is just plain scary. Why isn't there a bigger response to this?

share|improve this question
2  
Are you running Java WebStart? – mpez0 Apr 12 '10 at 21:01
    
Not familiar with WebStart - Sun says it's "included in the Java Runtime Environment" so I would guess that everyone running Java is running WebStart. – user34015 Apr 13 '10 at 17:57
    
Yes, WebStart is included with the standard JRE download from Sun, so if your browser has Java installed and working, it also has WebStart. – sleske Apr 15 '10 at 13:42
up vote 1 down vote accepted

Ok I'm not crazy - Oracle released a fix. http://www.h-online.com/security/news/item/Java-vulnerability-when-lyric-sites-attack-978283.html

share|improve this answer

I can only guess at why the Sun team doesn't consider this to be bad enough to issue an emergency update; development teams have to make calls like this and I suspect they felt that either the hole was too hard to exploit or the workaround was sufficient to prevent problems.

Anyway, if you feel strongly this is too big a risk for your system then you should implement one of the workarounds described in the article.

share|improve this answer
    
Yeah the problem is that the workarounds don't seem to work. I guess I was hoping for someone who knows more about Java than I do to tell me what the real risk is. – user34015 Apr 13 '10 at 17:54
    
How do you make a response an "Answer"? – user34015 Apr 15 '10 at 13:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.