full-disclosure - Re: [SE-2012-01] New Reflection API affected by a known 10+ years old attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 22 Jul 2013 18:12:56 +0300
From: Georgi Guninski <guninski@...inski.com>
To: Jeffrey Walton <noloader@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [SE-2012-01] New Reflection API affected by a
 known 10+ years old attack

On Sat, Jul 20, 2013 at 01:36:47PM -0400, Jeffrey Walton wrote:
> On Thu, Jul 18, 2013 at 12:50 AM, Security Explorations
> <contact@...urity-explorations.com> wrote:
> >
> > Hello All,
> >
> > We discovered yet another indication that new Reflection API introduced
> > into Java SE 7 was not a subject to a thorough security review (if any).
> I'm kind or surpised some of these bugs exist for so long. Allowing
> them to fester and rot can't be good (I have not been able to come up
> with a use case where it is desired or preferred).
> 
> Does anyone know anything about Oracle's engineering process? What is
> Oracle doing to ensure issues are tracked and remediated in reasonable
> time? What does the process include for code scanning to catch low
> hanging fruit? Are they using Find Bugs or Coverity (I checked
> scan.coverity.com, and I did not see Oracle Java or OpenJDK listed, so
> I wonder if they are doing it internally). What is the QA process
> doing to ensure items with negative impact are not allowed to pass?
> 
> Jeff
>


Can Coverity find logic bugs like missing checks?

To my knowledge some corporations use coverity for the low
hanging fruit, but it didn't kill a single high level logic bug in their
warez [ if( 0 == geteuid ) {....} doesn't count].

Maybe the halting problem complicates things in theory ;-)

-- 
georgi

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/