Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I got the following message from Fortify static code analyser.

Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks.

Can anyone explain how this can be serialization and de-serialization can lead to DoS?

share|improve this question
see the part "Preventing Denial-of-Service Attacks" at msdn.microsoft.com/en-us/library/ms733135.aspx (the info also applies to Java). – Louis Somers May 18 '12 at 10:20
(This is one of the DoS examples mentioned in the Secure Coding Guidelines for the Java Programming Language. oracle.com/technetwork/java/seccodeguide-139067.html#1-1 ) – Tom Hawtin - tackline May 18 '12 at 11:02

1 Answer

up vote 4 down vote accepted

If the serialized data is provided by an untrusted client, it can be manipulated.

Let's assume there is a linked list. The attacker can add a huge number of entries.

It may even be possible to created invalid serialized data. For example the length field of an array can be set to a very huge number. The server will allocate enough memory to store all elements, although they are never sent.

In some circumstances it is possible to trigger code that allocates other resources such as threads or files.

Last but not least there have been classes with bugs in their serialization code.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.