Bugtraq mailing list archives
Re: open socket in java
From: aviram () SECURITEAM COM (Aviram Jenik)
Date: Thu, 4 Feb 1999 23:16:04 +0200
nino wrote:
The implications are obvious. If any host can connect to the machine running the aplet, you could tell java to do things like the boserver. If you have a completely open socket, its rock n' roll !
No, it's not. Yes, you can connect to the open socket, but the applet can't do any I/O, so it's basically harmless (just like any other applet). The fact that the applet accepts outside connections is nothing by its own (besides a bad feeling it makes anybody that knows something about security...). The only possible security implication is performing some DoS on that socket or combining this with another exploits You definitely can't write a boserver in Java. -- ------------------------- Aviram Jenik "Addicted to Chaos" ------------------------- Today's quote: Religion ... is the opium of the masses. - Karl Marx, "Critique of the Hegelian Philosophy of Right", 1844
Current thread:
- open socket in java nino (Feb 03)
- <Possible follow-ups>
- Re: open socket in java Aviram Jenik (Feb 04)
- Re: open socket in java Hale (Feb 05)
- Re: open socket in java Lincoln Stein (Feb 05)
- Re: open socket in java Tim Wright (Feb 09)
- Re: open socket in java Toby Chamberlain (Feb 04)
- Re: open socket in java Simon Kilvington (Feb 05)
- Re: open socket in java Posick, Steve (Feb 09)
- FW: open socket in java Nin|a405 (Feb 11)
- Re: open socket in java Simon Kilvington (Feb 12)