Security aspects specific to the Java programming language, libraries, and virtual machine.

learn more… | top users | synonyms

11
votes
1answer
6k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
4
votes
1answer
390 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
5
votes
3answers
7k views

Java vulnerability: What about OpenJDK + IcedTea?

These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here. In the reports about ...
0
votes
1answer
776 views

Can Veracode detect vulnerabilities in jsp files?

We have chosen Veracode to perform security assessment of our JavaEE code. We have been performing white-box security testing using Veracode. As I am quite new to Veracode, I was surprised to find no ...
1
vote
2answers
393 views

Do XBAP applications have the same vulnerabilities as Java Web Apps?

In response to the popular decision in disabling Java Web Apps, there has been very little mention of XBAP applications. XBAP applications are similar to Silverlight but it offers more options to ...
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this "...
3
votes
2answers
3k views

How does Java 7 update 11 fix the security vulnerability?

There is a new Java released a couple days ago to resolve a hole that was recently discovered. (Oracle, US-CERT, NVD/NIST) In my initial reading about this update 11, I saw clearly where it by ...
3
votes
3answers
670 views

Java 7u11 - Safer to switch to 6?

Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now ...
10
votes
2answers
6k views

safe to use jBCrypt and recommend it to my organization?

I'd like to recommend to my fellow developers that we all use bcrypt to hash stored passwords. We all use java and I hesitate to recommend jBCrypt only because its latest version number (0.3) ...
2
votes
1answer
562 views

How disable Java in Chrome 23?

Well in case someone doesn't know yet... there is a new Java zero day. I'm trying to disable it on Chrome but I can't find any option. Google searches says that the option for deactivate it is on ...
1
vote
2answers
548 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
1answer
187 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
0
votes
2answers
299 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
3
votes
2answers
3k views

How secure is opening an incoming port for a java application?

If a java application is listening on UDP port xxxxx and a firewall is allowing connections to that java application through the same UDP port xxxxx, what vulnerabilities will a Windows 7 machine be ...
0
votes
1answer
134 views

Manually monitoring your PC for Java (Oracle) exploits?

Sandboxing and AV's aside, if I wanted to manually look at/monitor my system for where they usually enter it, where could I look for possible malicious Java viruses/activity, e.g., would they first ...
7
votes
1answer
11k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
3
votes
1answer
2k views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") ...
13
votes
5answers
7k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
14
votes
1answer
5k views

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if (!...
2
votes
3answers
525 views

Microsoft password strength checker

I typed in my password in Microsoft password strength checker website. Could it now be possible for someone to recover that password from my computer?
6
votes
1answer
621 views

Security announcement mailing list for Java

I didn't find a security announcement mailing list for Java (from Oracle). How to get notified about new Java patches? I am not interested in other Oracle products. For example Apple provides such a ...
3
votes
2answers
484 views

Secure Spring FrameworkUser Management

I got asked this question: "Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)? How do you guys do authz in Spring, including managing those roles ...
9
votes
4answers
7k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
4
votes
2answers
8k views

What password-based encryption to use with standard Java 6?

Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
3
votes
2answers
2k views

Java Applet for mutual authentication with smart card

I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client). In order to do this I thought the following scheme: 1.Tomcat (server) send ...
3
votes
1answer
470 views

Are OpenJDK and non-Windows systems vulnerable to the Sept. 25th 2012 Java vulnerability?

I have heard of this vulnerability, but although it was announced on the Full Disclosure list, it does not provide any details (other than a severity assessment). Does anyone have more info than me, ...
2
votes
1answer
7k views

How do I use OpenSSL with the Java Keytool?

I believe I understand how OpenSSL works, and I believe I have a good game plan for setting up an SSL server on my private network, but before I go through the process of downloading and configuring ...
1
vote
3answers
486 views

Java class type parameter vulnerability

In a Java programming book there is a section that details the JVM and memory addresses and location as it pertains to parameters of a class type. As you can see from the console output the initial ...
-5
votes
1answer
1k views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
6
votes
1answer
2k views

Is there any recommended Java library for penetration testing?

Does anyone have any recommendations for a good Java library which can be used for penetration testing? I once read about a library which I think was called 'Attack lib' but I can't find it anymore. ...
4
votes
3answers
1k views

Vulnerable java applications

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
8
votes
2answers
6k views

Storing password in Java application

What is best secure way to store passwords in Java web application? I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
1
vote
3answers
1k views

Java vulnerability applicability

On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application? See CVE-2011-3545, for which the vulnerable subcomponent is "...
2
votes
0answers
137 views

Need a little help with Metasploit and Java? [closed]

I'm a junior programmer and i was asked in my job to test java using metasploit... I followed this detailed environment: https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-...
8
votes
4answers
1k views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
3
votes
2answers
1k views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
1
vote
1answer
663 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
2
votes
1answer
562 views

Security at writing in a folder

I would like to run with Runtime.exec() programs in Java (the programs' code are in C and Java ) - the users are uploading the Java/C code, and my app runs them. The code is saved in a separate folder ...
1
vote
1answer
597 views

Network Sniffing Java Applet Authentication

Example, I have a java applet application, then this application is accepting userid and password as authentication. Can I sniff the userid and password on the network layer? Are the credential being ...
8
votes
1answer
4k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
2
votes
1answer
455 views

Is DWR (Direct Web Remoting) Secure?

Is DWR considered secure, or what may be required to secure Direct Web Remoting? Are there better options for hardened asynchronous communication?
2
votes
4answers
2k views

Bouncy Castle - document signed by sender and only readable by receiver?

I am building an application that requires secure data transfer. In particular, the sender has a data file that needs to be sent to the receiver. It is required that only the receiver be able to read ...
6
votes
2answers
1k views

Class.forName injection and constructor invocation

If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter) What's the worst possible consequence? The attacker does obtain stack traces. After ...
3
votes
1answer
338 views

Multibyte Character Exploits JSP/PostgreSQL

I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any ...
1
vote
1answer
1k views

Best Practices for Storing Digital Certificate

I'm building an application where certain sensitive files need to be digitally signed before being stored in the file system using ASN.1 encoding, so they can be verified against a digital certificate ...
1
vote
1answer
161 views

DoS and Serialization

I got the following message from Fortify static code analyser. Incorrect serialization and de-serialization can lead to unpredictable behavior and cause denial of service attacks. Can anyone ...
5
votes
0answers
14k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
3
votes
2answers
2k views

Secure communication between C# client and Java server, using certificates

I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on: server send RSA public key to ...
3
votes
2answers
1k views

Securing a Ubuntu system on Amazon Web Services

I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following: A relatively simple Java-based website (using the Noir framework) A Java-based ...
0
votes
1answer
964 views

PAP and CHAP implementation using Java

I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?