This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "J2EE Bad Practices: Sockets"
From OWASP
Weilin Zhong (talk | contribs) |
(→Description) |
||
| Line 2: | Line 2: | ||
==Description== | ==Description== | ||
| + | |||
| + | When using URLConnection to one restricted URL resource which is not available (offline) there is posibility that OS will leave those sockets opened (z/OS, Windows). When system starts new URLConnection opened sockets may be reused (including authentication). The URL destination may be reached by the user with lower credentials using previous credentials on that same socket. | ||
==Examples == | ==Examples == | ||
Revision as of 06:17, 12 June 2006
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
Description
When using URLConnection to one restricted URL resource which is not available (offline) there is posibility that OS will leave those sockets opened (z/OS, Windows). When system starts new URLConnection opened sockets may be reused (including authentication). The URL destination may be reached by the user with lower credentials using previous credentials on that same socket.
Examples
Related Threats
Related Attacks
Related Vulnerabilities
Related Countermeasures
Categories
This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.
