Hi Chris,
You're right that different platforms and languages are more or less likely
to lead to certain types of vulnerabilities. My experience is that they are
not wildly different, although PHP and Cold Fusion have historically been
very difficult for developers to use securely.
As we noted when drafting the OWASP Top Ten
(http://www.owasp.org/documentation/topten/background.html) it is extremely
difficult to find any reliable metrics about web application security. There
are basically four ways to determine whether an application has
vulnerabilities:
- automated external scanning
- manual penetration testing
- automated static analysis
- manual security code review
None of these methods are practiced on the majority of software projects.
And even if they were, none of them are very useful in isolation. Each
method has strengths and weaknesses in certain areas. There are a number of
other problems with gathering these metrics. In particular, our customers
tend to be companies that are already very interested in security, so
there's a strong selection bias at work.
I'm optimistic that the OWASP Metrics project can come up with some
meaningful metrics across various development languages and platforms, but
there simply isn't much quantitative data right now. As far as I'm
concerned, the OWASP Top Ten represents a decent list of the issues that are
likely to be the most significant for a broad range of projects.
--Jeff
----- Original Message -----
From: "Chris Vanden Berghe" <Chris@VandenBerghe.org>
To: "Jeff Williams" <jeff.williams@aspectsecurity.com>
Cc: <webappsec@securityfocus.com>
Sent: Wednesday, November 10, 2004 12:00 PM
Subject: Re: Sample JAVA application
Dear Jeff,
Do you keep statistics on the vulnerabilities you discover?
I'm not sure if I fully agree on your statement that Java is prone to
all common problems except for buffer overflows. Yes, Java is prone to
many of the same vulnerabilities that other platforms are vulnerable to,
but I would expect that the specific properties of the Java platform
make some classes of vulnerabilities more and others less likely in Java
compared to other platforms.
For example. while it is certainly possible to code an SQL injection
vulnerability in a Java application, it does mean that you are ignoring
the SQL prepared statements API. I would expect that PHP applications
are more likely to have SQL injection vulnerabilities since (the last
time I checked) PHP doesn't have such a good SQL API available.
It would be interesting to see the common vulnerabilities in Web
Applications -or general applications for that matter- per development
platform. I think we would see large differences depending on the
platform and the intended use of the applications.
In my case, I would be especially interested to have an overview of the
most important vulnerabilities for Java Web Application and Web Services.
Cheers,
Chris.
---
Jeff Williams wrote:
Chris,
We examine many large web apps and web services. The easy way to answer
your
question is that Java apps have all the common problems *except* buffer
overflows and related problems. The most common, in my opinion, are
problems
related to input validation, access control, and authentication.
--Jeff
Jeff Williams
Aspect Security, Inc.
http://www.aspectsecurity.com
----- Original Message -----
From: "Chris Vanden Berghe" <Chris@VandenBerghe.org>
To: <webappsec@securityfocus.com>
Sent: Friday, October 22, 2004 5:38 AM
Subject: Sample JAVA application
Hi all,
I'm working on practical security of Web Applications and Web Services,
especially on applications written in Java.
You find a lot of information about the typical WA vulnerabilities (SQL
inj, XSS, session handling errors, ...). Information that is more
difficult to find is on which vulnerabilities are more likely in
applications written in certain programming languages (or developed
using a particular framework, concepts or tools).
For my work it would be interesting to have an idea about which
vulnerabilities are often encountered in WA or WS written in Java (using
JSP, Servlets and EJB's).
Is there anybody on this list who has seen some results of penetration
tests or audits of Java WA/WS? What are the most common vulnerabilities
discovered?
Kind regards and thank you in advance,
Chris.
