Researcher publishes Java proof-of-concept to urge Apple action

Landon Fuller, a former Apple engineer, said he decided to publish an "innocuous" proof-of-concept for a previously-patched critical Sun Java vulnerability so that he could shed light on the severity of the issue. The Mac OS X platform, last updated May 12, still does not contain a fix for the bug, in addition to 12 other, now-fixed Java vulnerabilities, he said.

In an email, Fuller told SCMagazineUS.com that an unpatched user can be infected simply by visiting a website hosting a malicious Java applet.

"With the ability to run arbitrary code, an applet may perform any action on the user's system, on the user's behalf," he said.

Fuller, who in 2007 helped issue unofficial fixes for flaws disclosed by the Month of Apple Bugs Project, said he decided to publish the proof-of-concept in hopes Apple will realise the potential payload.

"The vulnerability has been publicly known for six months, fixed by multiple vendors and publicly described by several security researchers," Fuller said. "Unfortunately, Mac OS X issues often appear to be ignored if the severity of the issue is not adequately demonstrated."

Fuller published the proof-of-concept in a blog post. As a workaround, he suggested Mac OS X users disable Java applets in their browsers.

See original article on scmagazineus.com