3 ms·

Oracle has received many reports are received about application servers running on the network with unprotected ports taking serialization streams I’m just not

by gaius 8y ago

Oracle has received many reports are received about application servers running on the network with unprotected ports taking serialization streams I’m just not seeing how this is a problem with the language. Leave anything on an unprotected port taking unsanitised input and it’s vulnerable no matter what it is written in.

hurrrrr 8y ago
The problem is that the API pretends that it already sanitizes user input to a degree. (from the design perspective, not necessarily documentation) Sanitizing the input yourself means not using it. You can't sanitize it.
wepple 8y ago
> Leave anything on an unprotected port taking unsanitised input and it’s vulnerable no matter what it is written in I don’t think you’re comparing apples with apples. Even in a default configuration, the majority of services that show up on a network don’t give you instant code exec. Maybe tomcat servers with default passwords, and a few other things. But (de)serialization isn’t securable at all. You can’t add auth, you can’t WAF it, you can’t fix the underlying vulnerabilities. There is absolutely nothing which has that level of vulnerability and lack of security on a modern network.
- gaius 8y ago
  There is absolutely nothing which has that level of vulnerability and lack of security on a modern network. OK, let's say I overwrite part of your system with something evil, knowing that your app will Class.forName() it. Is that a problem with the ClassLoader or is the problem that your perimeter is already compromised anyway?
  - wepple 8y ago
    I don’t think it matters, at all. Java has serialization, and everyone uses it, and it’s a security nightmare. As uncomfortable as it may feel to me, I kinda agree with Oracles approach here: kill serialization, make things more secure. If they have to change core language/libraries, so be it. You were trying to say that anything left on a network socket will be compromised, and that’s simply not true. Most software is pretty solid. Anything in C will have more than it’s fair share of upcoming patches, but unlike Java serialization, you can’t fix a single lib to fix 99% of bugs.. or we would’ve surely done that.

by gaius 8y ago

hurrrrr 8y ago

The problem is that the API pretends that it already sanitizes user input to a degree. (from the design perspective, not necessarily documentation) Sanitizing the input yourself means not using it. You can't sanitize it.

wepple 8y ago

> Leave anything on an unprotected port taking unsanitised input and it’s vulnerable no matter what it is written in I don’t think you’re comparing apples with apples. Even in a default configuration, the majority of services that show up on a network don’t give you instant code exec. Maybe tomcat servers with default passwords, and a few other things. But (de)serialization isn’t securable at all. You can’t add auth, you can’t WAF it, you can’t fix the underlying vulnerabilities. There is absolutely nothing which has that level of vulnerability and lack of security on a modern network.

gaius 8y ago
There is absolutely nothing which has that level of vulnerability and lack of security on a modern network. OK, let's say I overwrite part of your system with something evil, knowing that your app will Class.forName() it. Is that a problem with the ClassLoader or is the problem that your perimeter is already compromised anyway?
- wepple 8y ago
  I don’t think it matters, at all. Java has serialization, and everyone uses it, and it’s a security nightmare. As uncomfortable as it may feel to me, I kinda agree with Oracles approach here: kill serialization, make things more secure. If they have to change core language/libraries, so be it. You were trying to say that anything left on a network socket will be compromised, and that’s simply not true. Most software is pretty solid. Anything in C will have more than it’s fair share of upcoming patches, but unlike Java serialization, you can’t fix a single lib to fix 99% of bugs.. or we would’ve surely done that.