EJB Bad Practices: Use of Class Loader - Revision history

KirstenS at 23:23, 7 April 2009

2009-04-07T23:23:24Z

KirstenS at 10:36, 14 February 2009

2009-02-14T10:36:21Z

KirstenS at 13:06, 30 October 2008

2008-10-30T13:06:22Z

KirstenS at 23:47, 23 September 2008

2008-09-23T23:47:35Z

Weilin Zhong at 15:40, 19 July 2006

2006-07-19T15:40:29Z

Weilin Zhong at 14:43, 19 July 2006

2006-07-19T14:43:33Z

Weilin Zhong at 18:34, 18 July 2006

2006-07-18T18:34:16Z

Weilin Zhong at 18:01, 18 July 2006

2006-07-18T18:01:37Z

Weilin Zhong at 17:53, 18 July 2006

2006-07-18T17:53:38Z

Weilin Zhong at 14:25, 18 July 2006

2006-07-18T14:25:56Z

New page

{{Template:Fortify}}

{{Template:Vulnerability}}

==Abstract==

The program violates the Enterprise JavaBeans specification by using the class loader.

==Description==

The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. [1]

In this case, the program violates the following EJB guideline:

"The enterprise bean must not attempt to create a class loader; obtain the current class loader; set the context class loader; set security manager; create a new security manager; stop the JVM; or change the input, output, and error streams."

A requirement that the specification justifies in the following way:

"These functions are reserved for the EJB container. Allowing the enterprise bean to use these functions could compromise security and decrease the container's ability to properly manage the runtime environment."

== References ==

[1] Enterprise JavaBeans 2.1 Specification. Sun Microsystems. http://java.sun.com/products/ejb/docs.html.

[[Category:API Abuse]]

[[Category:Java]]

[[Category:Implementation]]

← Older revision		Revision as of 23:23, 7 April 2009
Line 4:		Line 4:


−	~~__TOC__~~
−
−	~~[[ASDR Table of Contents]]~~

	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''		Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 1: / Line 1: @@
-{{Template:Vulnerability}}
+{{template:CandidateForDeletion}}
-{{Template:Fortify}}
 __TOC__
@@ Line 7: / Line 9: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
@@ Line 60: / Line 59: @@
 * [1] Enterprise JavaBeans 2.1 Specification. Sun Microsystems. http://java.sun.com/products/ejb/docs.html.

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
@@ Line 97: / Line 95: @@
 [[Category:Use of Dangerous API]]
 [[Category:API Abuse]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. [1]
@@ Line 18: / Line 27: @@
 "These functions are reserved for the EJB container. Allowing the enterprise bean to use these functions could compromise security and decrease the container's ability to properly manage the runtime environment."
-==Examples ==
+==Risk Factors==
-==Related Threats==
+==Related [[Attacks]]==
-==Related Attacks==
+* [[Attack 1]]
-==Related Countermeasures==
+==Related [[Vulnerabilities]]==
-== References ==
+* [[Vulnerability 1]]
-==Categories==
+==Related [[Controls]]==
 [[Category:Java]]
 [[Category:Implementation]]
 [[Category:Use of Dangerous API]]
 [[Category:API Abuse]]

← Older revision		Revision as of 15:40, 19 July 2006
Line 1:		Line 1:
		+	{{Template:Vulnerability}}
	{{Template:Fortify}}		{{Template:Fortify}}
−	~~{{Template:Vulnerability}}~~

	==Abstract==		==Abstract==

← Older revision		Revision as of 14:43, 19 July 2006
Line 1:		Line 1:
	{{Template:Fortify}}		{{Template:Fortify}}
−
	{{Template:Vulnerability}}		{{Template:Vulnerability}}

@@ Line 24: / Line 24: @@
 ==Related Attacks==
 ==Related Vulnerabilities==
@@ Line 42: / Line 40: @@
 [[Category:Use of Dangerous API]]