MS Java machine could enable 'attack applets'

MS Java machine could enable 'attack applets'

A security flaw in Microsoft's Java Virtual Machine could allow a Java applet to wreak havoc on a system if the user simply views a Web page or e-mail message.

The Princeton Secure Internet Programming team, Drew Dean at Xerox PARC and Dan Wallach at Rice University discovered the flaw in Java Virtual Machines with Internet Explorer 4 and 5 for Windows 95, 98 or NT. The security hole allows hackers to create an attack applet that is attached to an HTML page and delivered to Java Virtual Machines that have Internet Explorer and Outlook built in to them.

Such an attack applet could read files, change content, make network connections, set up a listening station or do other actions when it launched, said Gary McGraw, vice president of corporate technology at Reliable Software Technologies, a Virginia-based software consultancy. McGraw has worked with the Princeton team on other security matters.

"It's Melissa on steroids" by taking control of a victim's computer and performing any kind of action, he said.

According to Edward Felton, a professor at Princeton and a member of the programming team, no computer has been hit by the Java flaw yet.

McGraw said the flaw was discovered a couple of weeks ago but wasn't revealed until this week, when Microsoft issued a new version of Java Virtual Machine at and a security bulletin. He advised Java Virtual Machine users to download the new version.

"It's pure luck that the major flaws in Java haven't run wild" yet, McGraw said. Attack applets are the worse kind of Java flaw, and like other mobile code, the risks are serious, he said.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.


ARN Innovation Awards 2022

Innovation Awards is the market-leading awards program for celebrating ecosystem innovation and excellence across the technology sector in Australia.

EDGE 2022

EDGE is the leading technology conference for business leaders in Australia and New Zealand, built on the foundations of collaboration, education and advancement.

Show Comments