Such access normally is not allowed under the Java security framework. Apple has temporarily removed MRJ 1.5 from its Java site but will post a patch tomorrow. Web developer Dan Hughes, who runs the Webintosh site for Mac-related information, said he will post applets that demonstrate the potential problem by the end of the week. Theoretically, a Java programmer could exploit the flaw by writing a malicious applet that downloads to the user's system, then views, overwrites, or otherwise damages local files.
Users are only at risk if they visit a site where a malicious applet lives.
There have been many similar security flaws related to Java and Microsoft's ActiveX technology in the past year, but there have been few, if any, reported incidents of actual mischief on the Web. The Mac OS, including the latest System 8, does not use MRJ 1.5, so the only users at risk are those who have downloaded MRJ 1.5 since it was posted on Apple's Web site in August, Little said. He could not immediately say how many people have downloaded the software. Until they install the patch, IE 3.0 and 4.0 users should use Microsoft's virtual machine, which is included with the browser. Cyberdog users should either reinstall MRJ 1.0.2 or stop using Cyberdog until the 1.5 fix has been posted.