Re:Java 6 exploit found in the wild
by lucian1900 on Tuesday August 27, 2013 @10:23AM
(#6283571)
No other desktop apps are commonly sandboxed, so that's a minor issue, if an issue at all.
Re:Java 6 exploit found in the wild
by justincormack on Tuesday August 27, 2013 @10:46AM
(#6283730)
If they aren't sandboxes you don't need the vulnerability. Then the only question is if you can run untrusted code. Which is going to depend on the application.
If you're downloading an application and running it, it's pretty much immaterial whether it's Java-based or not; there's no vulnerability required to trash your computer at that point.
Sandboxes only apply in the browser, as far as I can think of -- Java code all executes in the context of a security manager, but does anyone actually set a custom security manager for running untrusted Java applications? (Maybe I'm just missing an example you know of...)
EDIT: To elaborate on jokc's reply (who appears to be shadowbanned), it seems that this exploit is only a problem for applications that use Java's sandboxing features, and the browser plugin is the best example of this -- but desktop applications can use these features too.