Java Debug Wire Protocol Remote Code Execution

This module abuses exposed Java Debug Wire Protocol services in order to execute arbitrary Java code remotely. It just abuses the protocol features, since no authentication is required if the service is enabled. This module requires Metasploit: https://metasploit.com/download Current source:...

Re: [Full-disclosure] Mozilla protocol abuse

Since I published this report it has come to my attention that Thunderbird 1.5, unlike Thunderbird 2.0, has not been patched with the "osint" security flag. As such all Thunderbird 1.5 users are vulnerable against this attack and those exploits. Now would be a good time to upgrade to Thunderbird...