lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <00bc01c71aeb$1393ab70$8210a8c0@moon1> Date: Fri, 8 Dec 2006 18:05:29 +0100 From: "Jan P. Monsch" <jan.monsch@...osion.com> To: <bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk> Subject: Enforcing Java Security Manager in Restricted Windows Environments? Hi Lately I came across several Citrix and Terminal Server projects which provide a restricted set of applications to their users. This is achieved using Windows Software Restriction Policies or AppSense Application Manager to white or black list executables. One of these permitted binaries is often java.exe. Now the problem arises that once Java is enabled any Java application can be executed on the system. This allows a malicious user to execute arbitrary Java code, like replacement shells (JSH), RDP clients (Propero Java RDP) and network port scanners. I could block java.exe but business requires that the company's Java application must still work. This lead me into this research on how to white list Java applications in a restricted Windows environment. For gory details see: http://www.iplosion.com/archives/54 So all this melts down to my question: Is there a way to tell java.exe to always use the Java Security Manager without the possibility of manipulation by the user? I would be very interested to learn your ideas. Kind regards Jan P. Monsch _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists