I think he's implying something that would be remotely exploitable on a server r... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

nkassis on July 13, 2015 | parent | context | favorite | on: First Java Zero-Day Attack in Two Years Targets NA...

I think he's implying something that would be remotely exploitable on a server running the JVM for a service with an open socket. Which is very common. Also the the File API could potentially be exploitable (if a vulnerability exist) remotely also if for example it was used for file uploads or something. Seems non-trivial but I can see how it could happen.

smackfu on July 13, 2015 [–]

True, if there was a vulnerability where reading a byte stream could trigger a JVM exploit, that is exploitable. But that would be a really weird bug, since the JVM isn't going to be the one parsing a byte stream.

nkassis on July 13, 2015 | [–]

There is also the standard library, it does a lot of stuff that could hide a vulnerability.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact