Researcher publishes Java proof-of-concept to urge Apple action
A security researcher who is upset that Apple has yet to patch a months-old vulnerability has published a proof-of-concept to demonstrate the exploit's severity.Landon Fuller, a former Apple engineer, said he decided to publish on Tuesday an "innocuous" proof-of-concept for a previously patched, critical Sun Java vulnerability so that he could shed light on the severity of the issue. The Mac OS X platform, last updated May 12, still does not contain the fix for the bug, in addition to 12 other, now-fixed Java vulnerabilities, he said.
In an email, Fuller told SCMagazineUS.com on Tuesday that an unpatched user can be infected simply by visiting a website hosting a malicious Java applet.
"With the ability to run arbitrary code, an applet may perform any action on the user's system, on the user's behalf," he said.
Fuller, who in 2007 helped issue unofficial fixes for flaws disclosed by the Month of Apple Bugs Project, said he decided to publish the proof-of-concept in hopes Apple will realize the potential payload.
"The vulnerability has been publicly known for six months, fixed by multiple vendors and publicly described by several security researchers," Fuller said. "Unfortunately, Mac OS X issues often appear to be ignored if the severity of the issue is not adequately demonstrated."
Fuller published the proof-of-concept in a Tuesday blog post. As a workaround, he suggested Mac OS X users disable Java applets in their browsers.
An Apple spokeswoman did not respond to a request for comment.
