J2EE Bad Practices: Sockets - Revision history

KirstenS at 20:16, 7 April 2009

2009-04-07T20:16:13Z

2009-02-17T14:06:33Z

2008-11-02T20:34:49Z

2008-09-26T17:16:17Z

2006-07-19T16:42:17Z

2006-07-19T14:45:35Z

2006-07-18T18:43:04Z

2006-07-18T18:03:55Z

2006-07-18T18:03:40Z

2006-07-18T14:44:24Z

Added contents from Fortify and moved previous description to "Examples" section.

← Older revision		Revision as of 20:16, 7 April 2009
Line 3:		Line 3:
	#REDIRECT [[Failure to follow guideline/specification]]		#REDIRECT [[Failure to follow guideline/specification]]

−	~~__TOC__~~
−
−	~~[[ASDR Table of Contents]]~~

	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''		Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 1: / Line 1: @@
-{{Template:Vulnerability}}
+{{template:CandidateForDeletion}}
-{{Template:Fortify}}
 __TOC__
@@ Line 8: / Line 9: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 68: / Line 68: @@
 TBD

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
@@ Line 104: / Line 103: @@
 [[Category:Communication]]
 [[Category:API Abuse]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 The J2EE standard permits the use of sockets only for the purpose of communication with legacy systems when no higher-level protocol is available. Authoring your own communication protocol requires wrestling with difficult security issues, including:
@@ Line 22: / Line 30: @@
-==Examples ==
+==Risk Factors==
 * When using URLConnection to one restricted URL resource which is not available (offline) there is posibility that OS will leave those sockets opened (z/OS, Windows). When system starts new URLConnection opened sockets may be reused (including authentication). The URL destination may be reached by the user with lower credentials using previous credentials on that same socket.
-==Related Attacks==
+==Related [[Attacks]]==
-==Related Countermeasures==
+==Related [[Vulnerabilities]]==
 URLConnection does not directly supports timeout. There is thread scenario possible which is a bit dirty.
 Solution: Use client socket and set timeout and linger flags.
 [[Category:Java]]
 [[Category:Use of Dangerous API]]
 [[Category:Communication]]
 [[Category:API Abuse]]

@@ Line 30: / Line 30: @@
 ==Related Attacks==
 ==Related Vulnerabilities==
@@ Line 47: / Line 45: @@
 [[Category:Communication]]