Instances from the class javax.net.ssl.SSLSocket must be created instead of normal Sockets when transferring objects over communication channels. The class SSLSockets provides security protocols such as SSL or TLS to ensure that the channel is not open to eavesdropping and malicious tampering.

The principal protections included in SSLSockets that are not provided by the Socket class are: Java API]

Integrity Protection. SSL protects against modification of messages by an active wiretapper.

Authentication. In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.

Confidentiality (Privacy Protection). In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data, so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.

Noncompliant Code Example

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. The insecure code for the corresponding client application follows the server's code.

class EchoServer { 
  public static void main(String[] args) { 
    try { 
      ServerSocket serverSocket = new ServerSocket(10007); 
      Socket socket = serverSocket.accept();
			
      PrintWriter out = new PrintWriter( socket.getOutputStream(),true); 
      BufferedReader in = new BufferedReader(new InputStreamReader( socket.getInputStream())); 

      String inputLine; 

      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
        out.println(inputLine); 
      } 

      out.close(); 
      in.close(); 
      socket.close();  
    }
    catch (Exception e) { /*Handle exception*/ }   
  }
}

class EchoClient {
  public static void main(String[] args) {
    try {
      Socket socket = new Socket("localhost", 9999);
						
      PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()));

      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
			
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      socket.close();
    }
    catch (Exception e) { /*Handle exception*/ } 
  }
}

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL and TLS security protocols.

class EchoServer {
  public static void main(String[] args) {
    try {
      SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
      SSLServerSocket sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(9999);
      SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();

      PrintWriter out = new PrintWriter( sslsocket.getOutputStream(),true);
      BufferedReader in = new BufferedReader(new InputStreamReader( sslsocket.getInputStream()));
            
      String inputLine; 
            
      while ((inputLine = in.readLine()) != null) { 
        System.out.println (inputLine); 
	out.println(inputLine); 
      } 
			
      out.close(); 
      in.close(); 
      sslsocket.close(); 
    } 
    catch (Exception e) { /*Handle exception*/ } 
  }
}

class EchoClient {
  public static void main(String[] args) {
    try {
      SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
      SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 9999);

      PrintWriter out = new PrintWriter(sslsocket.getOutputStream(), true);
      BufferedReader in = new BufferedReader(new InputStreamReader(sslsocket.getInputStream()));
			
      BufferedReader stdIn = new BufferedReader(new InputStreamReader(System.in));
            
      String userInput;

      while ((userInput = stdIn.readLine()) != null) {
        out.println(userInput);
	System.out.println(in.readLine());
      }

      out.close();
      in.close();
      stdIn.close();
      sslsocket.close();		
    } 
    catch (Exception e) { /*Handle exception*/ } 
  }
}

Note that a program that makes use of SSLSockets will block indefinitely if it tries to connect to a port that is not using SSL and, similarly, a program that does not use SSLSockets will block when trying to establish a connection through a port that uses SSL.

Risk assesment

Rule	Severity	Likelihood	Remediation Cost	Priority	Level
SEC09-J	medium	likely	high	P6	L2

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Exceptions

SEC36-EX1: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. If no sensitive information is being transmitted, or the channel is not prone to attacks, regular Sockets are sufficient.

References

[[API 06]]
[[Ware 08]]

SEC07-J. Do not allow the unauthorized construction of classes existing in forbidden packages 01. Platform Security (SEC) SEC09-J. Prefer using SSLSockets over Sockets for secure data exchange

Space shortcuts

Page tree