up vote 1 down vote favorite
share [g+] share [fb]

I recently saw this announcement on the H blog about a big hole in Java, but I can't seem to get anyone to think it's a big deal. The fact that I can visit a web site and it runs calc.exe on my local box is just plain scary. Why isn't there a bigger response to this?

link|improve this question
2  
Are you running Java WebStart? – mpez0 Apr 12 '10 at 21:01
Not familiar with WebStart - Sun says it's "included in the Java Runtime Environment" so I would guess that everyone running Java is running WebStart. – user34015 Apr 13 '10 at 17:57
Yes, WebStart is included with the standard JRE download from Sun, so if your browser has Java installed and working, it also has WebStart. – sleske Apr 15 '10 at 13:42
feedback

2 Answers

up vote 1 down vote accepted

Ok I'm not crazy - Oracle released a fix. http://www.h-online.com/security/news/item/Java-vulnerability-when-lyric-sites-attack-978283.html

link|improve this answer
feedback
up vote 0 down vote

I can only guess at why the Sun team doesn't consider this to be bad enough to issue an emergency update; development teams have to make calls like this and I suspect they felt that either the hole was too hard to exploit or the workaround was sufficient to prevent problems.

Anyway, if you feel strongly this is too big a risk for your system then you should implement one of the workarounds described in the article.

link|improve this answer
Yeah the problem is that the workarounds don't seem to work. I guess I was hoping for someone who knows more about Java than I do to tell me what the real risk is. – user34015 Apr 13 '10 at 17:54
How do you make a response an "Answer"? – user34015 Apr 15 '10 at 13:25
feedback

Your Answer

 
or
required, but never shown
discard