Mailing-List: contact dev-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Commons Developers List" <dev@commons.apache.org>
MIME-Version: 1.0
References: <20151106222553.00002c57.ecki@zusammenkunft.net>
 <563D3E10.9010906@gmail.com> <20151107042531.00007385.ecki@zusammenkunft.net>
 <563DCED8.5030302@gmail.com> <563DD02D.1040501@apache.org>
 <563F2188.3090905@gmail.com> <563F40D3.5060503@apache.org>
 <563F585C.6000600@gmail.com> <563F988F.8070003@apache.org>
 <CALznzY6yqFt-fDuSsXkUntV=BRy2snBNNUSqvwc_fUBLD5ONBA@mail.gmail.com>
 <563F9E27.6060604@gmail.com>
 <CALznzY639G0Pf8aauxVbAmO8zLeteZsOw6u+RBoSZ58LaCDAoQ@mail.gmail.com>
 <CALznzY7jTZ4GK0juphfgwRMhvjNaZ_krMSHJ35nJoNmC=rUNiA@mail.gmail.com>
 <563F9F7B.8060400@apache.org>
In-Reply-To: <563F9F7B.8060400@apache.org>
From: James Carman <james@carmanconsulting.com>
Date: Sun, 08 Nov 2015 19:17:04 +0000
Message-ID: 
 <CALznzY48ER0y1ifsff7ePBoG_iZZPXVJNk2ThPbsKjiXE1T49A@mail.gmail.com>
Subject: Re: [collection][security] InvokerTransformer missused in java object
 serialisation exploits
To: Commons Developers List <dev@commons.apache.org>
Content-Type: multipart/alternative; boundary=001a11347276fbbc5005240c529d

--001a11347276fbbc5005240c529d
Content-Type: text/plain; charset=UTF-8

Yes, I guess it should be prevented. Duh!
On Sun, Nov 8, 2015 at 2:16 PM Mark Thomas <markt@apache.org> wrote:

> On 08/11/2015 19:13, James Carman wrote:
> > If they can execute Runtime.exec then they can execute System.setProperty
>
> Yes. But the point you seem to seem to be missing is that if the system
> property is set such that this attack is blocked, they can't use the
> attack to change the system property and unblock it.
>
> Mark
>
>
> > On Sun, Nov 8, 2015 at 2:11 PM James Carman <james@carmanconsulting.com>
> > wrote:
> >
> >> System.setProperty()
> >>
> >>
> >> On Sun, Nov 8, 2015 at 2:10 PM Thomas Neidhart <
> thomas.neidhart@gmail.com>
> >> wrote:
> >>
> >>> On 11/08/2015 07:51 PM, James Carman wrote:
> >>>> Couldn't they use the same attack vector to set a system property
> also?
> >>> I
> >>>> do believe that would be possible
> >>>
> >>> for this you need a way to execute code via a de-serialized class.
> >>> Right now, the simplest way to do so is via the InvokerTransformer.
> >>>
> >>> There are surely other ways to do so, but if the only available way is
> >>> blocked (i.e. InvokerTransformer can not be deserialized), a remote
> >>> attacker cannot set a system property via this attack vector.
> >>>
> >>> btw. setting a system property can also be restricted by a
> >>> SecurityManager.
> >>>
> >>> I am -1 on a programmatic interface, and for the 4.X branch I propose
> to
> >>> remove the serialization support completely.
> >>>
> >>> Thomas
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> >>> For additional commands, e-mail: dev-help@commons.apache.org
> >>>
> >>>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>

--001a11347276fbbc5005240c529d--