lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <00bc01c71aeb$1393ab70$8210a8c0@moon1>
Date: Fri, 8 Dec 2006 18:05:29 +0100
From: "Jan P. Monsch" <jan.monsch@...osion.com>
To: <bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk>
Subject: Enforcing Java Security Manager in Restricted Windows Environments?

Hi

Lately I came across several Citrix and Terminal Server projects which
provide a restricted set of applications to their users. This is achieved
using Windows Software Restriction Policies or AppSense Application Manager
to white or black list executables.

One of these permitted binaries is often java.exe. Now the problem arises
that once Java is enabled any Java application can be executed on the
system. This allows a malicious user to execute arbitrary Java code, like
replacement shells (JSH), RDP clients (Propero Java RDP) and network port
scanners. I could block java.exe but business requires that the company's
Java application must still work.

This lead me into this research on how to white list Java applications in a
restricted Windows environment. For gory details see:
http://www.iplosion.com/archives/54

So all this melts down to my question: Is there a way to tell java.exe to
always use the Java Security Manager without the possibility of manipulation
by the user?

I would be very interested to learn your ideas.

Kind regards
Jan P. Monsch

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ