Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently saw this announcement on the H blog about a big hole in Java, but I can't seem to get anyone to think it's a big deal. The fact that I can visit a web site and it runs calc.exe on my local box is just plain scary. Why isn't there a bigger response to this?

share|improve this question
2  
Are you running Java WebStart? –  mpez0 Apr 12 '10 at 21:01
    
Not familiar with WebStart - Sun says it's "included in the Java Runtime Environment" so I would guess that everyone running Java is running WebStart. –  user34015 Apr 13 '10 at 17:57
    
Yes, WebStart is included with the standard JRE download from Sun, so if your browser has Java installed and working, it also has WebStart. –  sleske Apr 15 '10 at 13:42

2 Answers 2

up vote 1 down vote accepted

Ok I'm not crazy - Oracle released a fix. http://www.h-online.com/security/news/item/Java-vulnerability-when-lyric-sites-attack-978283.html

share|improve this answer

I can only guess at why the Sun team doesn't consider this to be bad enough to issue an emergency update; development teams have to make calls like this and I suspect they felt that either the hole was too hard to exploit or the workaround was sufficient to prevent problems.

Anyway, if you feel strongly this is too big a risk for your system then you should implement one of the workarounds described in the article.

share|improve this answer
    
Yeah the problem is that the workarounds don't seem to work. I guess I was hoping for someone who knows more about Java than I do to tell me what the real risk is. –  user34015 Apr 13 '10 at 17:54
    
How do you make a response an "Answer"? –  user34015 Apr 15 '10 at 13:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.