mailing list archives
Security-Assessment.com follows responsible disclosure
and promptly contacted Oracle after discovering
the issue. Oracle was contacted on August 1,
My understanding is that Stefano Di Paola of Minded Security reported
this back in April; and further, the feature was a part of reasonably
well-documented functionality of Java pretty much ever since:
"Two hosts are considered equivalent if both host names can be
resolved into the same IP addresses"
This was a pretty horrible design, so it's good to see it gone, though.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/