Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Michal Zalewski (lcamtufcoredump.cx)
Date: Wed Oct 20 2010 - 10:58:29 CDT
> Security-Assessment.com follows responsible disclosure
> and promptly contacted Oracle after discovering
> the issue. Oracle was contacted on August 1,
My understanding is that Stefano Di Paola of Minded Security reported
this back in April; and further, the feature was a part of reasonably
well-documented functionality of Java pretty much ever since:
"Two hosts are considered equivalent if both host names can be
resolved into the same IP addresses"
This was a pretty horrible design, so it's good to see it gone, though.