source: https://www.securityfocus.com/bid/1812/info An attacker may gain read access on remote systems by specifying a custom codebase in a Java applet, and delivering to the victim(s) via HTML email or a website. Any arbitrary codebase can be referenced by a java applet that was loaded by an tag in conjunction with a jar file when using Microsoft Internet Explorer or Outlook/Outlook Express. This allows for the possibility of any known file to be read by a remote attacker. Demo - IE 5.5/Outlook java security vulnerability - reading arbitrary local files and URLs Demo - IE 5.5/Outlook java security vulnerability - reading arbitrary local files and URLs
This page reads C:\TEST.TXT and displays the directory listing of C:\
Advisory
(C) Copyright 2000 Georgi Guninski

| Home | Internet Explorer | Windows 2000 | AIX | Netscape | Greets | More... |