RE: Java Web Start argument injection vulnerability
According to Sun's Java Web Start FAQ
http://java.sun.com/products/javawebstart/faq.html and other resources, a
JNLP can still specify and deliver a vulnerable JRE even after upgrading
your local copy. I'm no JNLP expert, but it looks like this could be
successfully applied to expose victims to previously patched
vulnerabilities.
Another method was proofed on this list:
http://www.securityfocus.com/archive/1/382413
How do you protect against an attacker forcing victims to use a vulnerable
JRE? This issue was previously mentioned on this list
http://www.securityfocus.com/archive/1/382281 but I did not see a protection
method.