The Java Plug-in establishes a connection between popular browsers and the Java platform.
According to Reston, Va.-based iDefense, which roots out malicious code, the vulnerability has been detected in Java 2 Platform, Standard Edition (J2SE) 1.4.2_01 and 1.4.2_04.
The security firm also believes that earlier versions of Java Virtual Machine are vulnerable and that browsers such as Internet Explorer, Mozilla and Firefox on both Windows and Unix platforms could be exploited if they are running a vulnerable JVM.
The vulnerability could provide a gateway for a hacker to bypass the Java sandbox and all security restrictions imposed within Java Applets and provide access to downloading, uploading or executing files within the user's PC, iDefense warned.
"Successful exploitation allows remote attackers to execute hostile Applets that can access files as well as access the network," iDefense stated.
According to the developer's definition, a JVM "mimics" a real Java processor, enabling Java bytecode to be executed as actions or operating system calls on any processor regardless of the operating system.
"A number of private Java packages exist within the JVM and are used internally by the VM," iDefense stated. "Security restrictions prevent applets from accessing these packages. Any attempt to access these packages, results in a thrown exception of 'AccessControlException,' unless the applet is signed and the user has chosen to trust the issuer."
The security firm is recommending that disabling Java or JavaScript will prevent exploitation as the vulnerability relies on the data transfer between the two components.
