Rich, thanks for the coverage. The reason we are leaving out a few details is that they are key to exploiting the issue through java, but not key to understanding the attack. Once sun has released their patch, we will provide the missing details, but companies should keep in mind this will not be the long term fix.

Billy Rios, John Heasman, Rob Carter, and I have already been in communication with a few vendors who are diligently working to address the issue. For any vendors who have questions, they can reach me at and I will do my best to help them address this issue. I will also have some updates on my blog at http://blogs.zdnet.com/security.

Thanks,

Nate McFeters