This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "J2EE Bad Practices: Sockets"
(→Description) |
(→Related Countermeasures) |
||
| Line 14: | Line 14: | ||
==Related Countermeasures== | ==Related Countermeasures== | ||
| + | |||
| + | URLConnection does not directly supports timeout. There is thread scenario possible which is a bit dirty. | ||
| + | Solution: Use client socket and set timeout and linger flags. | ||
==Categories== | ==Categories== | ||
Revision as of 06:19, 12 June 2006
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
Description
When using URLConnection to one restricted URL resource which is not available (offline) there is posibility that OS will leave those sockets opened (z/OS, Windows). When system starts new URLConnection opened sockets may be reused (including authentication). The URL destination may be reached by the user with lower credentials using previous credentials on that same socket.
Examples
Related Threats
Related Attacks
Related Vulnerabilities
Related Countermeasures
URLConnection does not directly supports timeout. There is thread scenario possible which is a bit dirty. Solution: Use client socket and set timeout and linger flags.
Categories
This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.
