It might be obvious, but just to clarify a bit, Brown Orifice is just a "nice" proof of concept for the 2 bugs.

Should someone decide to write an exploit using only the local filesystem access vulnerability to grab a few well-known critical files, you won't have a listening port to detect and it will be able to go through firewalls and proxies just like a normal web page.

filter java at your proxy level, threaten your users of horrible things if they don't disable java in netscape, or wait for the netscape fix and pray.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/70/2958#2958