293172 - firefox will automatically download a virus

Status: VERIFIED INVALID

(Firefox :: Security, defect)

Description

[knights_boy]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2

From Norton:

Source: C:\Documents and Settings\psyph3r\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\msjld.jar-5fda7c69-5beb07b9.zip 
Click for more information about this threat : Trojan.ByteVerify

Reproducible: Always

Steps to Reproduce:
1. go to http://my-car.homeip.net/performance/first/auto/warranty/
2. wait until the page finishes loading
Actual Results:  
norton said that it automatically deleted three different java viruses.
BlackBox.class, VB.class, beyond.class

Expected Results:  
i expect firefox not to be vunerable to simple java based virus files

Comment 1

[Jo Hermans]

Reporter, that's in the *java* cache. It wasn't downloaded by Firefox, but by
java. And it's also not a bug, because the data was sent by the webserver. You
can't blame Java or your webbrowser to download what it's being asked to do.
That's why you have anti-virus software.

Comment 2

[Matthias Versen [:Matti]]

no, you don't need antivirussoftware in that case.
The "virus" can't do anything (it's not active) unless you grant the java applet
full permissions (Java will ask).

Be sure that you have the latest JRE and you are save from kown security
problems in Java. 

-> invalid (It would be a bug in the Sun Javava Plugin if this virus would be
active)