From...

September 2, 1999
Web posted at: 3:04 p.m. EDT (1904 GMT)

by Kathleen Ohlson

(IDG) -- A security flaw in Microsoft Corp.'s Java Virtual Machine could allow a Java applet to wreak havoc on a system if the user simply views a Web page or e-mail message.

The Princeton Secure Internet Programming team, Drew Dean at Xerox PARC and Dan Wallach at Rice University discovered the flaw in Java Virtual Machines with Internet Explorer 4 and 5 for Windows 95, 98 or NT. The security hole allows hackers to create an attack applet that is attached to an HTML page and delivered to Java Virtual Machines that have Internet Explorer and Outlook built in to them.

Such an attack applet could read files, change content, make network connections, set up a listening station or do other actions when it launched,

MORE COMPUTING INTELLIGENCE
	IDG.net home page
Computerworld's home page
Computerworld Year 2000 resource center
Computerworld's online subscription center
Reviews & in-depth info at IDG.net
IDG.net's personal news page
Year 2000 World
Questions about computers? Let IDG.net's editors help you
Subscribe to IDG.net's free daily newsletter for IT leaders
Search IDG.net in 12 languages
News Radio
	Computerworld Minute
	Fusion audio primers

said Gary McGraw, vice president of corporate technology at Reliable Software Technologies Corp., a Dulles, Va.-based software consultancy. McGraw has worked with the Princeton team on other security matters.

"It's Melissa on steroids" by taking control of a victim's computer and performing any kind of action, he said.

According to Edward Felton, a professor at Princeton and a member of the programming team, no computer has been hit by the Java flaw yet.

McGraw said the flaw was discovered a couple of weeks ago but wasn't revealed until this week, when Microsoft issued a new version of Java Virtual Machine and a security bulletin on the company's official site (links below). He advised Java Virtual Machine users to download the new version.

"It's pure luck that the major flaws in Java haven't run wild" yet, McGraw said. Attack applets are the worse kind of Java flaw, and like other mobile code, the risks are serious, he said.