Original URL: http://www.theregister.co.uk/2012/09/26/gowdiak_claims_new_java_flaw/

New critical Java flaw claimed

Gowdiak strikes again with tale of sandbox bypass

By Simon Sharwood

Posted in Security, 26th September 2012 03:08 GMT

Oracle's Java is making a play to wrest back the title of world's leakiest code from Internet Explorer, after Polish researcher Adam Gowdiak claimed another critical flaw exists in the product.

The new claim is stated on the Full Disclosure mailing list where Gowdiak writes that the newly-found flaw impacts “all latest versions of Oracle Java SE software” and that it allows “a complete Java security sandbox bypass in the environment of Java SE 5, 6 and 7.” That's apparently worse than previous exploits, as they only hit Java 7.

Gowdiak also says “the bug allows to violate a fundamental security constraint of a Java Virtual Machine (type safety).”

There's not much detail beyond what we've quoted above, which is a little unusual for a Full Disclosure post.

It's also worth noting that there seems to be some grandstanding in Gowdiak's post, which he says he discovered the problem “exclusively” for Oracle's imminent JavaOne conference, commencing September 30th. He also taunts Larry Ellison, writing that he hopes news of the new flaw does not spoil his morning coffee. ®