Re: Sample JAVA application

[Chris Vanden Berghe <Chris () VandenBerghe org>]

Dear Jeff,

Do you keep statistics on the vulnerabilities you discover?

I'm not sure if I fully agree on your statement that Java is prone to 
all common problems except for buffer overflows.  Yes, Java is prone to 
many of the same vulnerabilities that other platforms are vulnerable to, 
but I would expect that the specific properties of the Java platform 
make some classes of vulnerabilities more and others less likely in Java 
compared to other platforms.

For example. while it is certainly possible to code an SQL injection 
vulnerability in a Java application, it does mean that you are ignoring 
the SQL prepared statements API.  I would expect that PHP applications 
are more likely to have SQL injection vulnerabilities since (the last 
time I checked) PHP doesn't have such a good SQL API available.

It would be interesting to see the common vulnerabilities in Web 
Applications -or general applications for that matter- per development 
platform.  I think we would see large differences depending on the 
platform and the intended use of the applications.

In my case, I would be especially interested to have an overview of the 
most important vulnerabilities for Java Web Application and Web Services.

Cheers,
Chris.

---
Jeff Williams wrote:
> Chris,
>
> We examine many large web apps and web services. The easy way to answer your
> question is that Java apps have all the common problems *except* buffer
> overflows and related problems. The most common, in my opinion, are problems
> related to input validation, access control, and authentication.
>
> --Jeff
>
> Jeff Williams
> Aspect Security, Inc.
> http://www.aspectsecurity.com
>
> ----- Original Message ----- 
> From: "Chris Vanden Berghe" <Chris () VandenBerghe org>
> To: <webappsec () securityfocus com>
> Sent: Friday, October 22, 2004 5:38 AM
> Subject: Sample JAVA application
>
>
>
> > Hi all,
> >
> > I'm working on practical security of Web Applications and Web Services,
> > especially on applications written in Java.
> >
> > You find a lot of information about the typical WA vulnerabilities (SQL
> > inj, XSS, session handling errors, ...).  Information that is more
> > difficult to find is on which vulnerabilities are more likely in
> > applications written in certain programming languages (or developed
> > using a particular framework, concepts or tools).
> >
> > For my work it would be interesting to have an idea about which
> > vulnerabilities are often encountered in WA or WS written in Java (using
> > JSP, Servlets and EJB's).
> >
> > Is there anybody on this list who has seen some results of penetration
> > tests or audits of Java WA/WS?  What are the most common vulnerabilities
> > discovered?
> >
> > Kind regards and thank you in advance,
> > Chris.