Coming on the heels of a number of similar vulnerabilities, Jelmer Kuperus, a software developer in the Netherlands, found and published a flaw in Sun's Java Web Start software that, in conjunction with known flaws in Internet Explorer, may allow untrusted and possibly malicious code to execute on a target system. 

Java Web Start (JWS) is Sun's solution to the problem of deploying applications to multiple machines over a network. With Java Web Start, users can download and execute applications from within a browser. To improve performance, application components including code and resources such as images are cached on disk once they are downloaded.

With any scheme utilizing downloaded code, security is clearly important. Java Web Start depends for its security on the familiar security infrastructure built into the Java platform. This security architecture consists of bytecode verification, security policies, permissions, and protection domains.

The published exploit depends on the fact that JWS application components are cached on disk in predictable locations. The exploit stores executable content in an innocuously named file, like "image.gif". A flaw in Internet Explorer allows this content to be executed.

Strictly speaking, this is an Internet Explorer bug that depends on questionable behavior in the Java Web Start application. It does, however, illuminate how software features are often at odds with software security. It's too bad that features sell software. The flaw also illustrates how unexpected interactions between otherwise secure applications can weaken the security of a system.