Page History

...

The default automatic signature verification process may still be used, but is not sufficient. Systems that use the default automatic signature verification process must perform additional checks to ensure that the signature is correct (such as comparing it against a known trusted signature).

Noncompliant Code Example

This noncompliant code example demonstrates the JarRunner application which can be used to dynamically execute a particular class residing within a JAR file (abridged version of the class in [Tutorials 2008]). It creates a JarClassLoader that loads an application update, plugin or patch over an untrusted network such as the Internet. The URL to fetch the code is specified as the first argument (for example, http://somewebsite.com/software-updates.jar); any other arguments specify the arguments that are to be passed to the class that is loaded. JarRunner uses reflection to invoke the main method of the loaded class. Unfortunately, by default, JarClassLoader verifies the signature using the public key contained within the JAR file.

Code Block

bgColor	#FFcccc

public class JarRunner {
  public static void main(String[] args) throws IOException, 
    ClassNotFoundException,NoSuchMethodException, InvocationTargetException {
  
    URL url = new URL(args[0]);
    
    // Create the class loader for the application jar file
    JarClassLoader cl = new JarClassLoader(url);
    
    // Get the application's main class name
    String name = cl.getMainClassName();
    
    // Get arguments for the application
    String[] newArgs = new String[args.length - 1];
    System.arraycopy(args, 1, newArgs, 0, newArgs.length);
    
    // Invoke application's main class
    cl.invokeClass(name, newArgs);
  }
}

final class JarClassLoader extends URLClassLoader {
  private URL url;
  public JarClassLoader(URL url) {
    super(new URL[] { url });
    this.url = url;
  }

  public String getMainClassName() throws IOException {
    URL u = new URL("jar", "", url + "!/");
    JarURLConnection uc = (JarURLConnection) u.openConnection();
    Attributes attr = uc.getMainAttributes();
    return attr != null ? attr.getValue(Attributes.Name.MAIN_CLASS) : null;
  }

  public void invokeClass(String name, String[] args)
      throws ClassNotFoundException, NoSuchMethodException,
      InvocationTargetException {
    Class c = loadClass(name);
    Method m = c.getMethod("main", new Class[] { args.getClass() });
    m.setAccessible(true);
    int mods = m.getModifiers();
    if (m.getReturnType() != void.class || !Modifier.isStatic(mods)
        || !Modifier.isPublic(mods)) { throw new NoSuchMethodException("main"); }
    try {
      m.invoke(null, new Object[] { args });
    } catch (IllegalAccessException e) { System.out.println("Access denied"); }
  }
}

Compliant Solution (`jarsigner`)

Users can — but usually do not — explicitly check JAR file signatures at the command line; this may be an adequate solution for programs that require manual installation of JAR files. Any malicious tampering results in a SecurityException when the jarsigner tool is invoked with the -verify option.

Code Block

bgColor	#ccccff

jarsigner -verify signed-updates-jar-file.jar

Compliant Solution (certificate chain)

When the local system cannot reliably verify the signature, the invoking program must verify the signature programmatically by obtaining the chain of certificates from the CodeSource of the class being loaded and checking whether any of the certificates belongs to a trusted signer whose certificate has been securely obtained beforehand and stored in a local keystore. This compliant solution demonstrates the necessary modifications to the invokeClass method.

...

The URLClassLoader and all its subclasses are given by default only enough permissions to interact with the URL that was specified when the URLClassLoader object was created. This means that the loaded code can interact only with the specified host. This fails to mitigate the risk completely, however, as the loaded code may have been granted privileges that permit other sensitive operations such as updating an existing local JAR file.

Risk Assessment

Failure to verify a digital signature, whether manually or programmatically, can lead to the execution of malicious code.

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
SEC19-J	high	probable	medium	P12	L1

Automated Detection

Wiki Markup

Automated detection is not feasible in the fully general case. However, an approach similar to Design Fragments \[[Fairbanks 07|AA. Bibliography#Fairbanks 07]\] could assist both programmers and static analysis tools.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9cb61f42542c8985-71b2fba8-448047b0-8717b113-03aaeb1a6f9be7f578ff1e0d"><ac:plain-text-body><![CDATA[	[[MITRE 2009	AA. Bibliography#MITRE 09]]	[CWE ID 300	http://cwe.mitre.org/data/definitions/300.html] "Channel Accessible by Non-Endpoint (aka 'Man-in-the-Middle')"	]]></ac:plain-text-body></ac:structured-macro>
	CWE ID 319 "Cleartext Transmission of Sensitive Information"
	CWE ID 494 "Download of Code Without Integrity Check"
	CWE ID 347 "Improper Verification of Cryptographic Signature"

Bibliography

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e5e0b70e765a4553-e499bc63-412a4bd7-b9a3983d-b04ea8336e97a0213a5122b2"><ac:plain-text-body><![CDATA[	[[API 2006	AA. Bibliography#API 06]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9f22765440ff3475-c0823700-42224316-a123a9aa-419b0ba9d1a10deec71af225"><ac:plain-text-body><![CDATA[	[[Bea 2008	AA. Bibliography#Bea 08]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0da2559b09263e37-a556b790-409e4c05-aa198222-633a3c0fcf11ac1cb6dc451d"><ac:plain-text-body><![CDATA[	[[Eclipse 2008	AA. Bibliography#Eclipse 08]]	[JAR Signing	http://wiki.eclipse.org/JAR_Signing] and [Signed bundles and protecting against malicious code	http://help.eclipse.org/stable/index.jsp?topic=/org.eclipse.platform.doc.isv/guide]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="67e669aa55f6be84-eaeed2b9-49c64efb-9e128bf2-68ff69abb4edf715cebb98ce"><ac:plain-text-body><![CDATA[	[[Fairbanks 07	AA. Bibliography#Fairbanks 07]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f9f77a8c022f8abe-9ed6d092-4ecf4865-a532b602-01ee4f16f5c594fee72b892d"><ac:plain-text-body><![CDATA[	[[Flanagan 2005	AA. Bibliography#Flanagan 05]]	Chapter 24. The java.util.jar Package	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f1164530567f312d-516a39eb-47b84eae-a2328a45-dfcca0b950344d71b883a4c3"><ac:plain-text-body><![CDATA[	[[Gong 2003	AA. Bibliography#Gong 03]]	12.8.3 jarsigner	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f3cd7ec190b83865-fddfa42d-49f14472-aa34afa6-ad16f1ee07e1dda25fe15b70"><ac:plain-text-body><![CDATA[	[[Halloway 2001	AA. Bibliography#Halloway 01]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2c5cd7ee07f07220-7775306b-4e274862-bd66a681-2d4c370845c6ace0e94103e8"><ac:plain-text-body><![CDATA[	[[JarSpec 2008	AA. Bibliography#JarSpec 08]]	Signature Validation		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3e8b265238f0f297-10f1d646-44814da5-89338bf2-f90acd172fe664513d626a69"><ac:plain-text-body><![CDATA[	[[Oaks 2001	AA. Bibliography#Oaks 01]]	Chapter 12: Digital Signatures, Signed Classes	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4f7d318098dedd17-1c3761d3-4ee54209-9fefa873-6fa8bcef096c69ff771eaf21"><ac:plain-text-body><![CDATA[	[[Muchow 2001	AA. Bibliography#Muchow 01]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="9837c26bb5d6e876-60440887-4752410c-81eda550-7a46905a699b5d3a8cba7f11"><ac:plain-text-body><![CDATA[	[[Tutorials 2008	AA. Bibliography#Tutorials 08]]	[The JarRunner Class	http://java.sun.com/docs/books/tutorial/deployment/jar/jarrunner.html], [Lesson: API and Tools Use for Secure Code and File Exchanges	http://java.sun.com/docs/books/tutorial/security/sigcert/index.html] and [Verifying Signed JAR Files	http://java.sun.com/docs/books/tutorial/deployment/jar/verify.html]	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 52

New Version 53

Key

Noncompliant Code Example

Compliant Solution (`jarsigner`)

Compliant Solution (certificate chain)

Risk Assessment

Automated Detection

Related Vulnerabilities

Related Guidelines

Bibliography

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 52

New Version 53

Key

Noncompliant Code Example

Compliant Solution (jarsigner)

Compliant Solution (certificate chain)

Risk Assessment

Automated Detection

Related Vulnerabilities

Related Guidelines

Bibliography

Compliant Solution (`jarsigner`)