Linked by Thom Holwerda on Wed 10th Oct 2012 23:47 UTC, submitted by MOS6510
Thread beginning with comment 538345
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Well you can't do anything useful for a malicious intent through Java.
(Unless you are going to send a few emails or something like it)
(Unless you are going to send a few emails or something like it)
What if the JVM is connected and authenticated to a database when the malicious program gets control. A malicious program can use JDBC to get sensitive information from that database without needing to go native.





Member since:
2007-02-18
You have to break out of the sandbox and what you do afterwards is platform dependent. "
But does it? If a Java vulnerability allows the VM itself to be controlled, the exploit can just run Java code with full permissions.
Much like how in the past, MS Office's Visual Basic potentially allowed malware to run on a Mac (again, not a security expert, so I don't know if it ended up being just hype, like Y2K).