Re: `Microsoft VM for Java' allows reading local files using `getSystemResourceAsStream'.

[regs () NEBCORP COM (Ari Gordon-Schlosberg)]

["TAKAGI, Hiromitsu" <takagi () ETL GO JP>]
> Microsoft JVM allows reading local files using getSystemResourceAsStream.
> For a detailed description, please see the following article.

Verified with build 5.00.2314.1003 on Win98.  Creepy.  According to the
article above, IE 5 allows files under C:\Windows\Desktop to read, while IE
4 gives access to C:\ itself.  Seems to me that there must be an a bug in
either java.lang.SecurityManager.checkRead(String,Object) or
java.lang.ClassLoader.getResourceAsStream(String).  If it's the former,
this bug should be further exploitable to pretty much any file.  Therefore,
most likely is that java.lang.ClassLoader.getResourceAsStream(String) is
either a) not calling java.lang.SecurityManager.checkRead(String,Object) at
all or b) passing it an incorrect context.

--
Ari                                                     there is no spoon
-------------------------------------------------------------------------
http://www.nebcorp.com/~regs/pgp for PGP public key