Re: Sample JAVA application

["Jeff Williams" <jeff.williams () aspectsecurity com>]

Chris,

We examine many large web apps and web services. The easy way to answer your
question is that Java apps have all the common problems *except* buffer
overflows and related problems. The most common, in my opinion, are problems
related to input validation, access control, and authentication.

--Jeff

Jeff Williams
Aspect Security, Inc.
http://www.aspectsecurity.com

----- Original Message ----- 
From: "Chris Vanden Berghe" <Chris () VandenBerghe org>
To: <webappsec () securityfocus com>
Sent: Friday, October 22, 2004 5:38 AM
Subject: Sample JAVA application


> Hi all,
>
> I'm working on practical security of Web Applications and Web Services,
> especially on applications written in Java.
>
> You find a lot of information about the typical WA vulnerabilities (SQL
> inj, XSS, session handling errors, ...).  Information that is more
> difficult to find is on which vulnerabilities are more likely in
> applications written in certain programming languages (or developed
> using a particular framework, concepts or tools).
>
> For my work it would be interesting to have an idea about which
> vulnerabilities are often encountered in WA or WS written in Java (using
> JSP, Servlets and EJB's).
>
> Is there anybody on this list who has seen some results of penetration
> tests or audits of Java WA/WS?  What are the most common vulnerabilities
> discovered?
>
> Kind regards and thank you in advance,
> Chris.