Re: [VulnWatch] The Java applet sandbox and stateful firewalls

From: Florian Weimer (fw_at_deneb.enyo.de)
Date: 08/01/05

  • Next message: alphademon: "HACK IN THE BOX SECURITY CONFERENCE 2005" 
    To: Dinis Cruz <dinis@ddplus.net>
Date: Mon, 01 Aug 2005 14:15:16 +0200

    * Dinis Cruz:

    > Is the Java Sandbox able to create outgoing connections on ports like 445?
    >
    > Also, even if it is possible, if a service like MS-SQL is already binded
    > to 1433, then wouldn't an error be thrown saying something like 'Port
    > already in use'.

    This doesn't matter because in the PORT command sent to the FTP-like
    server, the applet can reference a port which is not controlled by the
    applet. No checks take place, and it's perfectly possible to specify
    an already bound port. The firewall has no way to know that the port
    actually belongs to some other process on the host (not the applet/FTP
    client), and the sendbox does not examine the contents of TCP data
    transfers at all.

    Some NAT devices restrict access to 445/TCP, 139/TCP and a few more
    ports, but by its nature, this list is incomplete and does not cover
    all problematic TCP ports.

  • Next message: alphademon: "HACK IN THE BOX SECURITY CONFERENCE 2005"

    Relevant Pages

    • Java Applet and IIS
      ... applet code is working fine with IIS on port 80, ...
      (comp.lang.java)
    • Re: applet as servlet BACK end
      ... If I use a socket I'll use some dedicated port for the ... What I was afraid of was the fact that the applet will load from a web ... while the servlet runs on the SAME machine ... execution in the server, which is not what I want. ...
      (comp.lang.java.programmer)
    • [Full-disclosure] Re: [VulnWatch] The Java applet sandbox and stateful firewalls
      ... This doesn't matter because in the PORT command sent to the FTP-like ... the applet can reference a port which is not controlled by the ... all problematic TCP ports. ...
      (Full-Disclosure)
    • Re: Help Running Java Ap
      ... webvisu/WebVisu.class from the internet... ... I tried to connect to 208.51.57.70 on port 8080 with telnet to see, ... But telnet doesn't work. ... > Joining applet thread ... ...
      (comp.lang.java.help)
    • Re: Active-FTP Nat
      ... Auch dann wäre der Port im NAT offen. ... Eben, eigentlich nichts (wobei das Applet auf lokaler Seite noch nicht ...
      (de.comp.security.firewall)