User Tools

Site Tools


an_empirical_security_study_of_the_native_code_in_the_jdk

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
an_empirical_security_study_of_the_native_code_in_the_jdk [2014/01/09 00:36]
yann
an_empirical_security_study_of_the_native_code_in_the_jdk [2017/09/06 01:54] (current)
Line 1: Line 1:
-Tan, G. & Croft, J. An empirical security study of the native code in the JDK. Proceedings of the 17th Security Symposium, USENIX Association,​ 2008, 365-377+====== ​Tan, G. & Croft, J. An empirical security study of the native code in the JDK. Proceedings of the 17th Security Symposium, USENIX Association,​ 2008, 365-377 ​======
  
-====== Abstract ​======+ 
 +===== Abstract =====
  
 It is well known that the use of native methods in Java defeats Java's guarantees of safety and security, which is why the default policy of Java applets, for example, does not allow loading non-local native code. However, there is already a large amount of trusted native C/C++ code that comprises a significant portion of the Java Development Kit (JDK). We have carried out an empirical security study on a portion of the native code in Sun's JDK 1.6. By applying static analysis tools and manual inspection, we have identified in this security-critical code previously undiscovered bugs. Based on our study, we describe a taxonomy to classify bugs. Our taxonomy provides guidance to construction of automated and accurate bug-finding tools. We also suggest systematic remedies that can mediate the threats posed by the native code. It is well known that the use of native methods in Java defeats Java's guarantees of safety and security, which is why the default policy of Java applets, for example, does not allow loading non-local native code. However, there is already a large amount of trusted native C/C++ code that comprises a significant portion of the Java Development Kit (JDK). We have carried out an empirical security study on a portion of the native code in Sun's JDK 1.6. By applying static analysis tools and manual inspection, we have identified in this security-critical code previously undiscovered bugs. Based on our study, we describe a taxonomy to classify bugs. Our taxonomy provides guidance to construction of automated and accurate bug-finding tools. We also suggest systematic remedies that can mediate the threats posed by the native code.
  
-====== Comments ======+===== Comments ===== 
 //​Yann-Gaël Guéhéneuc,​ 2013/​10/​15//​ //​Yann-Gaël Guéhéneuc,​ 2013/​10/​15//​
  
an_empirical_security_study_of_the_native_code_in_the_jdk.1389227794.txt.gz · Last modified: 2017/09/06 01:54 (external edit)