1

I've heard java files can pose a significant security risk due to vulnerabilities. Is it possible for these java files to infect a computer with malware if they are never run?

In my case, I am downloading plugins for my Minecraft server running on my Raspberry Pi (a small project I'm quite proud about). There is always the possibility for one of those plugins to contain some sort of malicious code. Is it possible for the java file to infect my main computer simply by passing through "Downloads" and then getting copied through sftp to my Raspberry Pi?

2
  • 1
    No, but you should upload them to Virus Total as an additional security measure
    – MechMK1
    Dec 24 '20 at 19:57
  • Thanks @MechMK1 for the advice!
    – Harrison G
    Dec 26 '20 at 1:46
2

Unless a file is somehow auto-executed or otherwise opened by your system, it is not possible for malicious code to run.

-2

Edit: In your "Downloads", there is nothing particularly special about Java files as opposed to those of similar type and origin. The question asked is more general than the specific case elaborated, and there are general issues to be aware of.

Although I have no experience of Minecraft, security guidelines will typically state that there shouldn't be any potentially malicious code on the machine. There is a long history of one vulnerability allowing a file to be placed at a guessable location on a file system and another vulnerability allowing execution. Even in the old JRE it turned out that stray demo code in the Java Class Library could be executed, and as library classes would have full privileges.

How possibly could the code be executed.

  • Code executed as part of the installer.
  • Reflection using untrusted sources (this is the main reason why Java Serialisation and similar systems that copied Modula-3 are so bad). You don't even need to run a constructor or method to execute code.
  • Injection (i.e. parsing or printing) errors into command strings.
  • Deliberate name collisions.
  • Some other way I've not thought of - use your imagination.

There have been specific problems with jar files. The ZIP file format has no knowledge of hierarchy, which has lead to directory traversal attacks by starting file names with "../../../../". Many systems pass ZIP with zlib which is not memory safe - even when you think all the memory bugs have been found you can be surprised by another. ZIP files have many uses and other programs may ignore the file extension. ZIP files are typically read from the end (they are an archive format, so the offsets aren't known a priori), which in the past has led to a different executable file format being prepended to a valid and perhaps signed jar (see Billy Rios' GIFAR).

The moral: An "Ah well! That will do." attitude is not ideal for programming. But as always, you may decide that you'll live with the risks.

1
  • 1
    While everything you said in this answer is correct, it misses the point entirely.
    – MechMK1
    Dec 25 '20 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.