[39247] in bugtraq
Re: JBOSS 3.2.2-3.2.7 / 4.0.2 installation path disclosure /
daemon@ATHENA.MIT.EDU (scott.stark@jboss.com)
Wed Jun 22 11:54:12 2005
Date: 20 Jun 2005 14:29:25 -0000
Message-ID: <20050620142925.15063.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: scott.stark@jboss.com
To: bugtraq@securityfocus.com
You did not understand the suggested DownloadServerClasses change as this does not completely disable rmi class laoding. It simply restricts it to the classes/resources associated with ejb deployments as opposed to the complete server codebase. Removal of the dynamic class loading service still is a viable workaround as the need for dynamic class loading is something rarely used in production.
