Follow the Australian Telecommunications scene NEWSLETTER- FREE TRIAL
 |
 Stephen Withers turns his gaze on the world of Apple, with
detours into other aspects of IT and communications as they catch his
attention. |
Technology news and Jobs 
Our Blogs Core Dump No Java fix in Mac OS X 10.5.7
Our Blogs Core Dump No Java fix in Mac OS X 10.5.7 | No Java fix in Mac OS X 10.5.7 |
|
| by Stephen Withers | |
| Wednesday, 20 May 2009 | |
|
Page 1 of 3   
Featured Whitepaper
5 Best Practices for Smartphone Support
Even when Apple receives reports of flaws in its own software, the company isn't always quick to respond. For example, a vulnerability disclosed as part of the Month of Apple Bugs (January 2007) wasn't fixed until Security Update 2008-001 arrived in February 2008. Although Java is a Sun project, Java for Mac OS X is maintained by Apple. This means there's no workaround for Mac users. (If a security fix is released for Apache or one of the other open-source components, affected users have the option of installing the new version without waiting for Apple.) The first of a class of vulnerabilities in Java that allows applets in web pages to escape the Java sandbox was reported to Sun in August 2008 and fixed in December. Its discoverer, Sami Koivu, and another security researcher, Julien Tinnes, attacked this vulnerability using an exploit written by Tinnes at this year's Pwn2Own contest. Although they succeeded in subverting Safari and Firefox, the entry was disqualified as the underlying vulnerability had already been reported. In his blog, Tinnes explains how the vulnerability can be used to to give an applet whatever privileges the attacker wants. How does it work? See page 2. |
| < Next story in category | Previous story in the category > |
|---|
