Re: Phrack #60: "Java tears down the Firewall"

[Gary Flynn <flynngn () jmu edu>]

Dragos Ruiu wrote:

> On January 3, 2003 10:02 pm, Marcus J. Ranum wrote:
>  
>
> > Mikael Olsson wrote:
> >    
> >
> > > - The firewall automagically pokes a hole for this "data channel"
> > > - The server box is suddenly allowed to connect to this
> > > vulnerable port, through the firewall.
> > >      
> > Could the java app proxy to other ports internally? Seems
> > like a simple exercise for the malcoder.
> >
> > mjr.
> >    
>
> In theory the java security model was supposed to limit this.
> Practice so far has fallen short of theory. :-)
>
>  
Not to mention packaging a signed applet that would have no such 
restrictions
and making it socially attractive to disregard any security warnings. 
Not that
anyone would ever do such a thing :)

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards