© Silveira Neto

The toolkit provides only minimal validation of the URL parameter, allowing us to pass arbitrary parameters to the javaws [Java Web Start] utility, which provides enough functionality via command line arguments to allow this error to be exploited. The simplicity with which this error can be discovered has convinced me that releasing this document is in the best interest of everyone except the vendor.

Java creator James Gosling has resigned from Oracle -- and not, apparently, on particularly good terms.

"He resigned from the company earlier this month and has not taken up any other position," according to TechWhack. "Gosling said, 'As to why I left, it's difficult to answer: just about anything I could say that would be accurate and honest would do more harm than good.'"

"Gosling is known as the inventor of the Java programming language in 1994," writes Katonda's Swapnil Bhartiya. "He created the original design of Java and implemented its original compiler and virtual machine."

"No doubt every major Java vendor on Earth will be calling Gosling this week trying to get him onboard," writes InternetNews' Sean Michael Kerner. "A tech luminary like Gosling doesn't become available all that often."

"The news cannot be a total surprise given the very different cultures of Sun and Oracle, but losing such a high profile figure is unlikely to cheer up Larry Ellison," writes The Register's John Oates. "What is less certain is where this leaves the development of Java now that it's lost one of its loudest supporting voices."

Google researcher Tavis Ormandy has uncovered a Java vulnerability that could allow an attacker to run unauthorized programs on a victim's PC.

"They can do this because Java allows developers to tell the Java virtual machine to install alternate Java libraries," writes PCWorld's Robert McMillan. "By creating a malicious library and then telling the JVM to install it, an attacker could run his malicious program."

"The problem is with the Java Web Start framework, which allows developers an easy way to create Java applications," writes CNET News' Elinor Mills. "Disabling the Java plug-in will not protect against an attack, according to Ormandy."

"A patch is not yet available, but Ormandy suggests several workarounds," notes InformationWeek's Thomas Claburn. "He also says that Sun has been informed of the flaw but does not consider it serious enough to issue and patch outside of its quarterly cycle."

More here from The Register ... and more here from V3.co.uk.

Oracle has released a Java update that patches 27 security vulnerabilities.

"The new versions are Java, JDK and JRE 6 Update 19," writes PC Mag's Larry Seltzer. "JDK and JRE 5.0 Update 24 and SDK 1.4.2_26 are also updated, but have reached End of Service Life and are only supported on Solaris 9 and 10."

"Notable changes are the addition of seven new root SSL certificates and replacement of some older ones with new and improved versions, as well as the implementation of a warning dialog for Java Web Start applications that mix signed with unsigned code," according to Softpedia.

"While Oracle did not specifically disclose whether the flaws could allow an attacker to execute malicious code on a targeted system, the company noted that all 27 of the flaws could be remotely targeted and exploited without user authentication," writes V3.co.uk's Shaun Nichols.

More here from Watching the Watchers ... more here from eSecurity Planet ... and more here from ZDNet.