Re: Java and buffer overflows

From: Nelson Sampaio Araujo Junior (nelson@lunenetworks.com.br)
Date: 06/26/02 

From: "Nelson Sampaio Araujo Junior" <nelson@lunenetworks.com.br>
To: "Rafael Anschau" <rhanscha@terra.com.br>, <anschau.ez@terrra.com.br>
Date: Tue, 25 Jun 2002 21:40:33 -0300

Hi,

> I heard thatt java is invulnerable to bofs
> Has anyone succefully exploited a bof in java ?

Please notice that buffer overflow is only one way of software exploitation.
Generalizing the concept, any procedure that makes a software work badly,
and if possible be directed to do something you want (and obviously not
authorized), can be considered exploitation.

Please does not sit down and relax just because Java should not have buffer
overflows. There are inifinite ways of directing a software to do something
bad or not expected, and once more, buffer overflows (or overruns if you
prefer) is *just* one option.

Regards,

Nelson Junior
nelson@lunenetworks.com.br
nelson@LUNE.com.br

Relevant Pages

  • Re: Java and buffer overflows
    ... Java is presumably immune to bofs, due to the VM's boundchecking mechanisms. ... > Please notice that buffer overflow is only one way of software exploitation. ...
    (Vuln-Dev)
  • Re: Java and buffer overflows
    ... Although, as another poster said, native code invocation is going to ... application server that happened to be written in Java. ... > Please notice that buffer overflow is only one way of software exploitation. ...
    (Vuln-Dev)
  • [NT] Lotus Notes Multiple Buffer Overflows and Directory Traversal
    ... Lotus Notes Multiple Buffer Overflows and Directory Traversal ... Successful exploitation requires that the user is e.g. tricked into ... HTML Speed Reader Link Buffer Overflow: ... 04/08/2005 - Initial vendor notification regarding Directory Traversal ...
    (Securiteam)
  • Re: IP Level Encryption
    ... The memory used by process A can be claimed by another process B ... >> will enable an attacker to execute arbitrary code, in Java this is ... any buffer overflow is detected and there is no ... Although I am also fond of Delphi, I don't think that it is a full ...
    (sci.crypt)
  • RE: Stack Overflow
    ... I am hardly a java expert myself, however in _theory_ a buffer overflow is ... possible in any language (assuming the underlying chip's instruction set ...
    (Security-Basics)