4 ms·
> But you'd actually have to try if you wanted Java to be able to write arbitrary memory or execute arbitrary code. Depends on your definition of arbitrary. Hi
by shanemhansen 10y ago
> But you'd actually have to try if you wanted Java to be able to write arbitrary memory or execute arbitrary code.
Depends on your definition of arbitrary. Higher level languages have higher level exploits. While injecting x86 shellcode into a java process is probably hard, many java applications have been vulnerable to serialization bugs which result in the execution of arbitrary bytecode.
Source: http://www.darkreading.com/informationweek-home/why-the-java-deserialization-bug-is-a-big-deal/d/d-id/1323237 http://www.darkreading.com/informationweek-home/why-the-java...
- pcwalton 10y agoNobody is saying RCE is impossible in memory safe languages, just much less likely.
- askyourmother 10y agoAnd this needs to be said more "RCE is possible in Rust", because sometimes it is portrayed in almost unassailable terms.
- pcwalton 10y agoIt also needs to be said that this is generally not a reasonable reason to pick C over Rust. Memory-safe languages are effective defenses against these flaws.