4 ms·

> I'm still not quite sure why LDAP comes into the picture According to https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Mani

by fauria 5y ago

> I'm still not quite sure why LDAP comes into the picture According to https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-... , SecurityManager is not enforced on remote class loading when using JNDI's LDAP server provider interface.

isbvhodnvemrwvn 5y ago
Let's be honest, barely anyone even uses SecurityManager in the real world.
- jsiepkes 5y ago
  There is even a JEP to remove the SecurityManager all together: https://openjdk.java.net/jeps/411 https://openjdk.java.net/jeps/411
  - feurio 5y ago
    There is even a JEP to remove the SecurityManager!