Dear Jeff,
Do you keep statistics on the vulnerabilities you discover?
I'm not sure if I fully agree on your statement that Java is prone to
all common problems except for buffer overflows. Yes, Java is prone to
many of the same vulnerabilities that other platforms are vulnerable to,
but I would expect that the specific properties of the Java platform
make some classes of vulnerabilities more and others less likely in Java
compared to other platforms.
For example. while it is certainly possible to code an SQL injection
vulnerability in a Java application, it does mean that you are ignoring
the SQL prepared statements API. I would expect that PHP applications
are more likely to have SQL injection vulnerabilities since (the last
time I checked) PHP doesn't have such a good SQL API available.
It would be interesting to see the common vulnerabilities in Web
Applications -or general applications for that matter- per development
platform. I think we would see large differences depending on the
platform and the intended use of the applications.
In my case, I would be especially interested to have an overview of the
most important vulnerabilities for Java Web Application and Web Services.
Cheers,
Chris.
---
Jeff Williams wrote:
Chris,
We examine many large web apps and web services. The easy way to answer your
question is that Java apps have all the common problems *except* buffer
overflows and related problems. The most common, in my opinion, are problems
related to input validation, access control, and authentication.
--Jeff
Jeff Williams
Aspect Security, Inc.
http://www.aspectsecurity.com
----- Original Message -----
From: "Chris Vanden Berghe" <Chris@VandenBerghe.org>
To: <webappsec@securityfocus.com>
Sent: Friday, October 22, 2004 5:38 AM
Subject: Sample JAVA application
Hi all,
I'm working on practical security of Web Applications and Web Services,
especially on applications written in Java.
You find a lot of information about the typical WA vulnerabilities (SQL
inj, XSS, session handling errors, ...). Information that is more
difficult to find is on which vulnerabilities are more likely in
applications written in certain programming languages (or developed
using a particular framework, concepts or tools).
For my work it would be interesting to have an idea about which
vulnerabilities are often encountered in WA or WS written in Java (using
JSP, Servlets and EJB's).
Is there anybody on this list who has seen some results of penetration
tests or audits of Java WA/WS? What are the most common vulnerabilities
discovered?
Kind regards and thank you in advance,
Chris.
