Reappearance of an old IE security bug

[bam () DIMENSIONAL COM (Ben Mesander)]

I have found a way to have a Java applet open a connection to an arbitrary
host and violate the Java security model in Internet Explorer 5. This is a bug
I first discovered in 1997, and Microsoft fixed it then. It seems to
have reappeared in the latest IE 5.

This vulnerability allows malicious websites to download a java applet to
a user's desktop, and use the desktop to send content from sites inside a
firewall to the malicious webserver or another host.

http://www.hungry.com/~ben/msie_bug/

--Ben