Java反序列化漏洞和缓解措施

2017 IEEE Cybersecurity Development (SecDev) Pub Date : 2017-09-01 DOI:10.1109/SECDEV.2017.13

R. Seacord

{"title":"Java反序列化漏洞和缓解措施","authors":"R. Seacord","doi":"10.1109/SECDEV.2017.13","DOIUrl":null,"url":null,"abstract":"This tutorial provides developers with practical guidance for securely implementing Java Serialization. Java deserialization is a clear and present danger as its widely used both directly by applications and indirectly by Java subsystems such as RMI (Remote Method Invocation), JMX (Java Management Extension), JMS (Java Messaging System). Deserialization of untrusted streams can result in remote code execution (RCE), denial-of service (DoS), and a range of other exploits. Applications can be vulnerable to these attacks even if they did nothing wrong","PeriodicalId":415145,"journal":{"name":"2017 IEEE Cybersecurity Development (SecDev)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"4","resultStr":"{\"title\":\"Java Deserialization Vulnerabilities and Mitigations\",\"authors\":\"R. Seacord\",\"doi\":\"10.1109/SECDEV.2017.13\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"This tutorial provides developers with practical guidance for securely implementing Java Serialization. Java deserialization is a clear and present danger as its widely used both directly by applications and indirectly by Java subsystems such as RMI (Remote Method Invocation), JMX (Java Management Extension), JMS (Java Messaging System). Deserialization of untrusted streams can result in remote code execution (RCE), denial-of service (DoS), and a range of other exploits. Applications can be vulnerable to these attacks even if they did nothing wrong\",\"PeriodicalId\":415145,\"journal\":{\"name\":\"2017 IEEE Cybersecurity Development (SecDev)\",\"volume\":\"1 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2017-09-01\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"4\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2017 IEEE Cybersecurity Development (SecDev)\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/SECDEV.2017.13\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2017 IEEE Cybersecurity Development (SecDev)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/SECDEV.2017.13","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 4

摘要

本教程为开发人员提供了安全实现Java序列化的实用指导。Java反序列化是一个明显而现实的危险，因为它被应用程序直接使用，也被诸如RMI(远程方法调用)、JMX (Java管理扩展)、JMS (Java消息传递系统)等Java子系统间接使用。不受信任流的反序列化可能导致远程代码执行(RCE)、拒绝服务(DoS)和一系列其他漏洞。应用程序可能容易受到这些攻击，即使它们没有做错任何事情

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文本刊更多论文

Java Deserialization Vulnerabilities and Mitigations

This tutorial provides developers with practical guidance for securely implementing Java Serialization. Java deserialization is a clear and present danger as its widely used both directly by applications and indirectly by Java subsystems such as RMI (Remote Method Invocation), JMX (Java Management Extension), JMS (Java Messaging System). Deserialization of untrusted streams can result in remote code execution (RCE), denial-of service (DoS), and a range of other exploits. Applications can be vulnerable to these attacks even if they did nothing wrong

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

2017 IEEE Cybersecurity Development (SecDev)

自引率

0.00%

发文量