Re: Sample JAVA application

["Jeff Williams" <jeff.williams () aspectsecurity com>]

Hi Chris,

You're right that different platforms and languages are more or less likely
to lead to certain types of vulnerabilities. My experience is that they are
not wildly different, although PHP and Cold Fusion have historically been
very difficult for developers to use securely.

As we noted when drafting the OWASP Top Ten
(http://www.owasp.org/documentation/topten/background.html) it is extremely
difficult to find any reliable metrics about web application security. There
are basically four ways to determine whether an application has
vulnerabilities:
    - automated external scanning
    - manual penetration testing
    - automated static analysis
    - manual security code review

None of these methods are practiced on the majority of software projects.
And even if they were, none of them are very useful in isolation. Each
method has strengths and weaknesses in certain areas. There are a number of
other problems with gathering these metrics. In particular, our customers
tend to be companies that are already very interested in security, so
there's a strong selection bias at work.

I'm optimistic that the OWASP Metrics project can come up with some
meaningful metrics across various development languages and platforms, but
there simply isn't much quantitative data right now.  As far as I'm
concerned, the OWASP Top Ten represents a decent list of the issues that are
likely to be the most significant for a broad range of projects.

--Jeff

----- Original Message ----- 
From: "Chris Vanden Berghe" <Chris () VandenBerghe org>
To: "Jeff Williams" <jeff.williams () aspectsecurity com>
Cc: <webappsec () securityfocus com>
Sent: Wednesday, November 10, 2004 12:00 PM
Subject: Re: Sample JAVA application


> Dear Jeff,
>
> Do you keep statistics on the vulnerabilities you discover?
>
> I'm not sure if I fully agree on your statement that Java is prone to
> all common problems except for buffer overflows.  Yes, Java is prone to
> many of the same vulnerabilities that other platforms are vulnerable to,
> but I would expect that the specific properties of the Java platform
> make some classes of vulnerabilities more and others less likely in Java
> compared to other platforms.
>
> For example. while it is certainly possible to code an SQL injection
> vulnerability in a Java application, it does mean that you are ignoring
> the SQL prepared statements API.  I would expect that PHP applications
> are more likely to have SQL injection vulnerabilities since (the last
> time I checked) PHP doesn't have such a good SQL API available.
>
> It would be interesting to see the common vulnerabilities in Web
> Applications -or general applications for that matter- per development
> platform.  I think we would see large differences depending on the
> platform and the intended use of the applications.
>
> In my case, I would be especially interested to have an overview of the
> most important vulnerabilities for Java Web Application and Web Services.
>
> Cheers,
> Chris.
>
> ---
> Jeff Williams wrote:
> > Chris,
> >
> > We examine many large web apps and web services. The easy way to answer
your
> > question is that Java apps have all the common problems *except* buffer
> > overflows and related problems. The most common, in my opinion, are
problems
> > related to input validation, access control, and authentication.
> >
> > --Jeff
> >
> > Jeff Williams
> > Aspect Security, Inc.
> > http://www.aspectsecurity.com
> >
> > ----- Original Message ----- 
> > From: "Chris Vanden Berghe" <Chris () VandenBerghe org>
> > To: <webappsec () securityfocus com>
> > Sent: Friday, October 22, 2004 5:38 AM
> > Subject: Sample JAVA application
> >
> >
> >
> > > Hi all,
> > >
> > > I'm working on practical security of Web Applications and Web Services,
> > > especially on applications written in Java.
> > >
> > > You find a lot of information about the typical WA vulnerabilities (SQL
> > > inj, XSS, session handling errors, ...).  Information that is more
> > > difficult to find is on which vulnerabilities are more likely in
> > > applications written in certain programming languages (or developed
> > > using a particular framework, concepts or tools).
> > >
> > > For my work it would be interesting to have an idea about which
> > > vulnerabilities are often encountered in WA or WS written in Java (using
> > > JSP, Servlets and EJB's).
> > >
> > > Is there anybody on this list who has seen some results of penetration
> > > tests or audits of Java WA/WS?  What are the most common vulnerabilities
> > > discovered?
> > >
> > > Kind regards and thank you in advance,
> > > Chris.