--- a/src/share/classes/com/sun/corba/se/impl/presentation/rmi/InvocationHandlerFactoryImpl.java	Mon Jul 22 13:59:51 2013 +0100
+++ b/src/share/classes/com/sun/corba/se/impl/presentation/rmi/InvocationHandlerFactoryImpl.java	Mon Jul 22 19:38:08 2013 -0700
@@ -43,6 +43,8 @@
 import com.sun.corba.se.spi.orbutil.proxy.DelegateInvocationHandlerImpl ;
 import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandler ;
 import com.sun.corba.se.spi.orbutil.proxy.CompositeInvocationHandlerImpl ;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 
 public class InvocationHandlerFactoryImpl implements InvocationHandlerFactory
 {
@@ -114,24 +116,32 @@
         // which extends org.omg.CORBA.Object.  This handler delegates all
         // calls directly to a DynamicStubImpl, which extends
         // org.omg.CORBA.portable.ObjectImpl.
-        InvocationHandler dynamicStubHandler =
+        final InvocationHandler dynamicStubHandler =
             DelegateInvocationHandlerImpl.create( stub ) ;
 
         // Create an invocation handler that handles any remote interface
         // methods.
-        InvocationHandler stubMethodHandler = new StubInvocationHandlerImpl(
+        final InvocationHandler stubMethodHandler = new StubInvocationHandlerImpl(
             pm, classData, stub ) ;
 
         // Create a composite handler that handles the DynamicStub interface
         // as well as the remote interfaces.
         final CompositeInvocationHandler handler =
             new CustomCompositeInvocationHandlerImpl( stub ) ;
+
+        AccessController.doPrivileged(new PrivilegedAction<Void>() {
+            @Override
+            public Void run() {
         handler.addInvocationHandler( DynamicStub.class,
             dynamicStubHandler ) ;
         handler.addInvocationHandler( org.omg.CORBA.Object.class,
             dynamicStubHandler ) ;
         handler.addInvocationHandler( Object.class,
             dynamicStubHandler ) ;
+                return null;
+            }
+        });
+
 
         // If the method passed to invoke is not from DynamicStub or its superclasses,
         // it must be from an implemented interface, so we just handle

--- a/src/share/classes/com/sun/corba/se/spi/orbutil/proxy/CompositeInvocationHandlerImpl.java	Mon Jul 22 13:59:51 2013 +0100
+++ b/src/share/classes/com/sun/corba/se/spi/orbutil/proxy/CompositeInvocationHandlerImpl.java	Mon Jul 22 19:38:08 2013 -0700
@@ -36,6 +36,7 @@
 
 import com.sun.corba.se.spi.logging.CORBALogDomains ;
 import com.sun.corba.se.impl.logging.ORBUtilSystemException ;
+import com.sun.corba.se.impl.presentation.rmi.DynamicAccessPermission;
 
 public class CompositeInvocationHandlerImpl implements
     CompositeInvocationHandler
@@ -46,11 +47,13 @@
     public void addInvocationHandler( Class interf,
         InvocationHandler handler )
     {
+        checkAccess();
         classToInvocationHandler.put( interf, handler ) ;
     }
 
     public void setDefaultHandler( InvocationHandler handler )
     {
+        checkAccess();
         defaultHandler = handler ;
     }
 
@@ -78,4 +81,12 @@
 
         return handler.invoke( proxy, method, args ) ;
     }
+
+    private static final DynamicAccessPermission perm = new DynamicAccessPermission("access");
+    private void checkAccess() {
+        final SecurityManager sm = System.getSecurityManager();
+        if (sm != null) {
+            sm.checkPermission(perm);
 }
+    }
+}