Re: [Full-disclosure] [SE-2012-01] New Reflection API affected by a known 10+ years old attack

[Georgi Guninski <guninski@xxxxxxxxxxxx>]

On Sat, Jul 20, 2013 at 01:36:47PM -0400, Jeffrey Walton wrote:
> On Thu, Jul 18, 2013 at 12:50 AM, Security Explorations
> <contact@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> >
> > Hello All,
> >
> > We discovered yet another indication that new Reflection API introduced
> > into Java SE 7 was not a subject to a thorough security review (if any).
> I'm kind or surpised some of these bugs exist for so long. Allowing
> them to fester and rot can't be good (I have not been able to come up
> with a use case where it is desired or preferred).
> 
> Does anyone know anything about Oracle's engineering process? What is
> Oracle doing to ensure issues are tracked and remediated in reasonable
> time? What does the process include for code scanning to catch low
> hanging fruit? Are they using Find Bugs or Coverity (I checked
> scan.coverity.com, and I did not see Oracle Java or OpenJDK listed, so
> I wonder if they are doing it internally). What is the QA process
> doing to ensure items with negative impact are not allowed to pass?
> 
> Jeff
>


Can Coverity find logic bugs like missing checks?

To my knowledge some corporations use coverity for the low
hanging fruit, but it didn't kill a single high level logic bug in their
warez [ if( 0 == geteuid ) {....} doesn't count].

Maybe the halting problem complicates things in theory ;-)

-- 
georgi

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/