Frank DENIS random thoughts.

Hardening MacOSX against the Java vulnerability

Marc Schoenefeld writes:

“regarding the regarding OSX java threat CVE-2008-5353 you can either join the current panic, or fix the issue in five minutes yourself.

If you belong to the second group of people you can follow the steps listed here, and also on

Basically the approach takes non-vulnerable classes from a fixed java version (like sun jdk 1.5.0_18 and makes it available to the OSX java class loader, which then fixes the issue). It is a non-intrusive fix, so it does not impair any patch (if any) that apple will rollout.

  1. Get the of a recent non-OSX java distribution (like Sun Java 5/JDK 1.5.0_18 for Linux)
  2. unzip java/util/
  3. javac java/util/
  4. zip /somepath/FixedCalendar.jar java/util/Calendar*.class
  5. In ~/Library/Caches/Java/ set option deployment.javapi.jre.1.5.0.args=-Xbootclasspath/p:/somepath/FixedCalendar.jar
  6. Start up a browser, browse to, see the dancing duke, open Java Console, press s, you should now see FixedCalendar.jar in the sun.boot.class.path
  7. If you are brave, try the PoC exploit on, it should give you a bootstrap failure now”