This isn't that surprising really. Microsoft's focus on security 10 or so years ago has paid off and its hard to find flaws in their OS now. The next most common platform is probably the JVM so its the new attack vector.
I would imagine we are going to see more and more of these exploits unless Oracle takes the same approach that Microsoft took, and even then it will be years before the benefits are felt.
The attack did stop at the Java process level. But once you're into that, you have the same privileges as anything else the user is running, by design. That's the same model taken by, well, every other OS out there effectively; it's not a problem as long as long as you have a separation of user account levels.
the flaw would be exploitable on any machine with Java 5,
6, or 7 enabled (whether it’s Windows 7 64-bit, Mac OS X,
Linux, or Solaris
[...]
“An attacker could then install programs, view, change,
or delete data with the privileges of a logged-on user.”
In short, you can rag on modern operating system design because whatever permissions you grant to the Java process (regardless of operating system) are the same permissions which get inherited by the exploit. If you run the Java process under sudo on Linux, then the exploit runs under sudo as well.
Unable to comment intelligently on this, I am not familiar with the exploit. I can only comment on the fact that Microsoft has spent a huge chunk of cash and time fixing their code. Most exploits on the Windows side are from applications running on it these days.
Taking a guess I would imagine its because the JVM is doing something it shouldn't be, similar to how Adobe products continually have flaws found in them, which isn't the fault of the OS.
If that's the case blaming Microsoft would be like blaming the Linux kernel for being exploited when the actual attack was against a service like Apache running under the root account. Unless you intelligently run things under proper accounts all the OS security in the world won't save you if there is a flaw in something running on it.
While it's possible that Java just hasn't been as much of a target, the difference between Windows and IE (which are the two M$ products that particularly got them into trouble with security flaws) and Java's JVM, other than one being an OS, one being a browser, and the other being a runtime environment, is that the former two started off being buggy and got better, and the JVM has been in the news for more security problems since Oracle took over. I think the finger to point is at Oracle. From what I have heard about how things went when they were taking over, I think the issue is that they are too "enterprise" for their own good. Sun's lawyers were pretty awful (or too good depending on whether you like suing) too though, so maybe some was inherited.
One other thing before I go- are other JVM languages affected by these bugs?
First, this bug existed at least for a year before Oracle acquired Sun. Same with almost all the other bugs that have plagued the JVM in recent years. I don't think pointing the finger at Oracle is worthwhile here.
Second, the parent wasn't comparing the products but the security practices followed; MS's hardcore security practices are well known and have served them very well over the last decade. The products they make have little to nothing to do with this.
Lastly, the language you use has absolutely nothing to do with this bug -- it's a JVM bug itself.
In a sense none of the "JVM languages" are affected: apparently it's a bug in the Web applets sandbox implementation. It's not something used by standalone Java (or whatever) programs. It only matters if you are running Java applets off a web page.
I would imagine we are going to see more and more of these exploits unless Oracle takes the same approach that Microsoft took, and even then it will be years before the benefits are felt.