Are managed programming languages immune to arbitrary code execution exploits?

Question

Classic example of arbitrary code execution is when a stack based buffer overflows, overwrites the return address so the control can jump into the attacker's carefully set up data to execute a shell code to enter the system.

If you develop in C and write lots of code, eventually you screw up somewhere, and your code becomes exploitable.

In managed languages like C#, Java, etc. arrays are bounds checked, doesn't have pointers that can dangle (they are garbage collected), etc. It looks like memory corruptions, buffer overflows and other nasty stuff that can allow an attacker take over the computer is not possible from managed code, is that true?

I'm asking this because I plan to abandon C and C++, and use C# or Java just for security reasons for parts where performance is not critical.

Answer 1

Assuming the implementation of those languages is flawless, then sure. However, that's almost never the case. For example, arbitrary code execution exploits have been found for JavaScript engines.
Furthermore, even with a perfectly "safe" language you can still be exploited. A common source of arbitrary code execution is from deserializing unsanitized user input.

Answer 2

Java suffers from an overflow vulnerability because the ranges of Java types are not symmetric.

Because the ranges of Java types are not symmetric (the negation of each minimum value is one more than each maximum value), even operations such as unary negation can overflow if applied to a minimum value. Because the java.lang.math.abs() method returns the absolute value of any number, it can also overflow if given the minimum int or long as an argument.

You can read more about that on the SEI Secure Coding Wiki here: https://wiki.sei.cmu.edu/confluence/display/java/NUM00-J.+Detect+or+prevent+integer+overflow