Java HotSpot Cryptographic Provider signature verification vulnerability

An attacker can add a cryptographic provider containing cipher
implementation signed by an untrusted certificate. The attacker can
also create his or her own jurisdiction policy files signed by an
untrusted certificate.
In order to achieve this, the attacker must first of all add a fake
cryptographic provider (with index 1) with special
CertificateFactory.X.509 implementation. Such provider is not required
to be signed. This implementation can return attacker's own untrusted
certificate instead of one of the old JCE code signing certificates.
This vulnerability is caused by using CertificateFactory#getInstance
without specifying "SUN" provider in the code which is responsible for
providers (and jurisdiction policy) signature verification.
This applies to all versions of Java HotSpot SE 5 and 6.
More details and code samples here:
http://java.zacheusz.eu/provider-signature-verif-vuln-2/273/
Regards,
Zacheusz Siedlecki