...
| Wiki Markup |
|---|
Some JVMs allow agents to be started when the JVM is already running. This is not secureinsecure in a production environment. Refer to the JVMTI documentation \[[JVMTI 2006|AA. Bibliography#JVMTI 06]\] for platform specific information on enabling/disabling this feature. |
...
Agents may run under the default security manager without requiring any permissions to be granted. While the JVMTI is useful for debuggers and profilers, such levels of access may be are inappropriate for all users of the JVMdeployed production code.
Compliant Solution
Do not start the JVM with any agents enabled on a production machine. This compliant solution removes the -agentlib command line argument and installs a security manager, as required by guideline ENV02-J. Create a secure sandbox using a Security Manager.
| Code Block | ||
|---|---|---|
| ||
${JDK_PATH}/bin/java -Djava.security.manager ApplicationName
|
Also, it It is necessary important to disable the environment variable JAVA_TOOL_OPTIONS so that JVMTI agents cannot be specified via this route.
...
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
ENV07-J | low | unlikely | medium | P2 | L3 |
Automated Detection
TODONot amenable to automated static analysis.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
...