Process Control - Revision history

Imifos: Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2017-11-10T21:48:39Z

Moved page into the right category. See Java space page for me details. Content has not been reviewed in this edit.

2015-12-01T12:58:03Z

uniformisation categories

2009-05-27T18:28:16Z

Reverting to last version not containing links to www.textoubasrel.com

2009-05-21T20:15:31Z

2009-02-28T11:18:00Z

‎Example 2

2009-02-27T13:43:13Z

‎Example 1

2009-02-27T13:41:51Z

2009-02-19T13:47:18Z

2008-11-05T23:24:17Z

2008-09-30T13:02:42Z

@@ Line 104: / Line 104: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Input Validation Vulnerability]]
-[[Category:OWASP Java Project]]
+[[Category:Java]]
 [[Category:Code Snippet]]
 [[Category:Vulnerability]]

@@ Line 104: / Line 104: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Input Validation Vulnerability]]
-[[Category:Java]]
+[[Category:OWASP Java Project]]
 [[Category:Code Snippet]]
 [[Category:Vulnerability]]

@@ Line 43: / Line 43: @@
 ===Example 2===
-The following code is from an administrative web application designed allow users to kick off a backup of an Oracle database using a batch-file wrapper around the rman utility and then run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single command line parameter, which specifies what type of backup to perform. Because access to the database is restricted, the application runs the backup as a privileged user.
+The following code is from an administrative web application designed to allow users to kick off a backup of an Oracle database using a batch-file wrapper around the rman utility and then run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single command line parameter, which specifies what type of backup to perform. Because access to the database is restricted, the application runs the backup as a privileged user.
 <pre>

@@ Line 29: / Line 29: @@
 ===Example 1===
-The following Java code from a system utility uses thesystem property APPHOME to determine the directory in which it is installed and then executes an initialization script based on a relative path from the specified directory.
+The following Java code from a system utility uses the system property APPHOME to determine the directory in which it is installed and then executes an initialization script based on a relative path from the specified directory.
 <pre>

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
 [[ASDR Table of Contents]]
@@ Line 8: / Line 7: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
 Executing commands from an untrusted source or in an untrusted environment can cause an application to execute malicious commands on behalf of an attacker.

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 Process control vulnerabilities take two forms:
@@ Line 19: / Line 27: @@
 # By executing the command, the application gives an attacker a privilege or capability that the attacker would not otherwise have.
 ==Examples ==
 ===Example 1===
@@ Line 64: / Line 77: @@
 The environment plays a powerful role in the execution of system commands within programs. Functions like system() and exec() use the environment of the program that calls them, and therefore attackers have a potential opportunity to influence the behavior of these calls.
-==Related Threats==
+==Related [[Attacks]]==
-==Related Attacks==
+Error Handling Vulnerability
-[[Command Injection]]
+Input Validation Vulnerability
-==Related Vulnerabilities==
+Logging and Auditing Vulnerability
-==Related Countermeasures==
+Session Management Vulnerability]]
-[[:Category:Input Validation]]
+__NOTOC__
 [[Category:Input Validation Vulnerability]]
 [[Category:Java]]
 [[Category:Code Snippet]]