We have verified that our demonstration applet does not work on Navigator 4.5. These systems allow digitally signed applets. If an applet's signer is labelled as trusted by the local system, then the applet is not subject to the normal security restrictions. The flaw we found allows an applet to change the system's idea of who signed it. The result is that the applet can completely evade Java's security mechanisms.
More details are available .
For more details, see our technical report . The flaw is serious, allowing an attacker to create a Web page that victimizes any Explorer user who visits the attacker's page. This flaw is fixed in Internet Explorer 3.01. We discovered two new security flaws, one affecting Netscape Navigator , and one affecting Microsoft Internet Explorer . Browser versions affected are Netscape Navigator 3.0 beta 5 and earlier, and Microsoft Internet Explorer 3.0 beta 2 and earlier.