[9373] in bugtraq
Re: open socket in java
daemon@ATHENA.MIT.EDU (Aviram Jenik)
Fri Feb 5 05:17:34 1999
Date: Thu, 4 Feb 1999 23:16:04 +0200
Reply-To: Aviram Jenik <aviram@SECURITEAM.COM>
From: Aviram Jenik <aviram@SECURITEAM.COM>
X-To: nino@INFORM.DK
To: BUGTRAQ@NETSPACE.ORG
nino wrote:
> The implications are obvious. If any host can connect to the machine
> running the aplet, you could tell java to do things like the boserver.
> If
> you have a completely open socket, its rock n' roll !
>
No, it's not.
Yes, you can connect to the open socket, but the applet can't do any I/O, so
it's basically harmless (just like any other applet).
The fact that the applet accepts outside connections is nothing by its own
(besides a bad feeling it makes anybody that knows something about
security...). The only possible security implication is performing some DoS
on that socket or combining this with another exploits
You definitely can't write a boserver in Java.
--
-------------------------
Aviram Jenik
"Addicted to Chaos"
-------------------------
Today's quote:
Religion ... is the opium of the masses.
- Karl Marx, "Critique of the Hegelian Philosophy
of Right", 1844
