No Java fix in Mac OS X 10.5.7

Stephen Withers
Wednesday, 20 May 2009 09:24

Opinion and Analysis

In a nutshell, it works by deserialising a maliciously crafted Calendar object in a way that delivers a routine that can be used to define classes with arbitrary privileges.

(See Tinnes' blog for a more detailed description.)

The important point that he makes is that a reliable exploit can be written in Java ("mine is over 500 lines but you can make a simpler version"), and it will work regardless of the hardware, operating system or browser. No platform-specific machine code is needed

"This is close to the holy grail of client-side vulnerabilities," he claimed.

The specific vulnerability used in the example has been patched by Sun, but survives in Java for Mac OS X.

"I believe that since this vulnerability has already been public for almost 6 months, making MacOS X users aware that Java needs to be disabled in their browser is the good thing to do," he wrote.

Tinnes recommends Mac OS X users disable Java in their web browsers.

Tinnes isn't the only one raising the alarm - please read on.