An attacker can add a cryptographic provider containing cipher implementation signed by an untrusted certificate. The attacker can also create his or her own jurisdiction policy files signed by an untrusted certificate. In order to achieve this, the attacker must first of all add a fake cryptographic provider (with index 1) with special CertificateFactory.X.509 implementation. Such provider is not required to be signed. This implementation can return attacker's own untrusted certificate instead of one of the old JCE code signing certificates. This vulnerability is caused by using CertificateFactory#getInstance without specifying "SUN" provider in the code which is responsible for providers (and jurisdiction policy) signature verification. This applies to all versions of Java HotSpot SE 5 and 6. More details and code samples here: http://java.zacheusz.eu/provider-signature-verif-vuln-2/273/ Regards, Zacheusz Siedlecki
