RE: Sample JAVA application

["Scott, Richard" <Richard.Scott () bestbuy com>]

In my opinion, I look for lack of control particularly how the
applications implement authentication.  When dealing with, specifically,
Java based services; I've also kept a look out for such applications
being used as conduits to other services where buffer overflows be used.
Often web services act as a transport/portal to a non java based
application.  While this is in the minority of web services I have seen,
I have ran in to it a couple of times.

For the large usage of web services, most clients look at leakage of
confidential information and/or unauthorized use of a sensitive
operation the web service offers.

Cheers,
Richard
-----Original Message-----
From: Jeff Williams [mailto:jeff.williams () aspectsecurity com] 
Sent: Sunday, October 24, 2004 9:23 PM
To: Chris Vanden Berghe; webappsec () securityfocus com
Subject: Re: Sample JAVA application

Chris,

We examine many large web apps and web services. The easy way to answer
your
question is that Java apps have all the common problems *except* buffer
overflows and related problems. The most common, in my opinion, are
problems
related to input validation, access control, and authentication.

--Jeff

Jeff Williams
Aspect Security, Inc.
http://www.aspectsecurity.com

----- Original Message ----- 
From: "Chris Vanden Berghe" <Chris () VandenBerghe org>
To: <webappsec () securityfocus com>
Sent: Friday, October 22, 2004 5:38 AM
Subject: Sample JAVA application


> Hi all,
>
> I'm working on practical security of Web Applications and Web
Services,
> especially on applications written in Java.
>
> You find a lot of information about the typical WA vulnerabilities
(SQL
> inj, XSS, session handling errors, ...).  Information that is more
> difficult to find is on which vulnerabilities are more likely in
> applications written in certain programming languages (or developed
> using a particular framework, concepts or tools).
>
> For my work it would be interesting to have an idea about which
> vulnerabilities are often encountered in WA or WS written in Java
(using
> JSP, Servlets and EJB's).
>
> Is there anybody on this list who has seen some results of penetration
> tests or audits of Java WA/WS?  What are the most common
vulnerabilities
> discovered?
>
> Kind regards and thank you in advance,
> Chris.