Secunia

A vulnerability has been reported in Sun Java Web Start, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error in Java Web Start and can be exploited by an untrusted application to grant itself permissions to overwrite any file that is writable by the user running the application. This can further be exploited to overwrite the user's ".java.policy" file allowing the application to invoke applets or Java Web Start applications.

The vulnerability affects Java Web Start in JDK and JRE 5.0 Update 11 and earlier and Java Web Start in SDK and JRE 1.4.2_13 and earlier for the Windows platform.

Solution
Apply updates.
Further details available in Customer Area

Provided and/or discovered by
John Heasman, NGSSoftware

Changelog
Further details available in Customer Area

Original Advisory
Sun:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1

NGSSoftware:
http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-java-web-start/

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area