According to Sun's Java Web Start FAQ http://java.sun.com/products/javawebstart/faq.html and other resources, a JNLP can still specify and deliver a vulnerable JRE even after upgrading your local copy. I'm no JNLP expert, but it looks like this could be successfully applied to expose victims to previously patched vulnerabilities. Another method was proofed on this list: http://www.securityfocus.com/archive/1/382413 How do you protect against an attacker forcing victims to use a vulnerable JRE? This issue was previously mentioned on this list http://www.securityfocus.com/archive/1/382281 but I did not see a protection method.
