...
- Integrity Protection. SSL protects against modification of messages by an active wiretapper.
- Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
- Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.
Noncompliant Code Example
This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. Te insecure code for the corresponding client application follows the server's code.
| Code Block | ||
|---|---|---|
| ||
import java.net.ServerSocket;
import java.net.Socket;
import java.io.*;
public class EchoServer {
public static void main(String[] args) {
try {
ServerSocket serverSocket = new ServerSocket(10007);
Socket socket = serverSocket.accept();
PrintWriter out = new PrintWriter( socket.getOutputStream(),true);
BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null) {
System.out.println (inputLine);
out.println(inputLine);
}
out.close();
in.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
{code:bgColor=#FFCCCC}
import java.io.*;
import java.net.*;
public class EchoClient {
public static void main(String[] args) {
try {
Socket socket = new Socket("localhost", 9999);
PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));
BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
String userInput;
while ((userInput = stdIn.readLine()) != null) {
out.println(userInput);
System.out.println(in.readLine());
}
out.close();
in.close();
stdIn.close();
socket.close();
}
catch (Exception e) {
/*Handle exception*/
}
}
}
|
Compliant solution
This compliant solution makes use of SSLSockets to protect packets using the SSL and TLS security protocols.
...
Note that a program that makes use of SSLSockets will hang if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will hang when trying to establish a connection through a port that uses SSL.
Risk assesment
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SEC12-J | medium | likely | high | P6 | L2 |
Exceptions
SEC36-EX1: Because of all the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead can be incurred. If no sensitive information is being transmitted, or the channel used is not prone to attacks, the implementation of regular Sockets is sufficient.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] \[[Ware 08|AA. Java References#Ware 08]\] |