["TAKAGI, Hiromitsu" <takagiat_private>] > Microsoft JVM allows reading local files using getSystemResourceAsStream. > For a detailed description, please see the following article. > Verified with build 5.00.2314.1003 on Win98. Creepy. According to the article above, IE 5 allows files under C:\Windows\Desktop to read, while IE 4 gives access to C:\ itself. Seems to me that there must be an a bug in either java.lang.SecurityManager.checkRead(String,Object) or java.lang.ClassLoader.getResourceAsStream(String). If it's the former, this bug should be further exploitable to pretty much any file. Therefore, most likely is that java.lang.ClassLoader.getResourceAsStream(String) is either a) not calling java.lang.SecurityManager.checkRead(String,Object) at all or b) passing it an incorrect context. -- Ari there is no spoon ------------------------------------------------------------------------- http://www.nebcorp.com/~regs/pgp for PGP public key
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:32:54 PDT