Java Components Vulnerabilities - An Experimental Classification Targ eted at the OSGi Platform - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Rapport (Rapport De Recherche) Année : 2007

Java Components Vulnerabilities - An Experimental Classification Targ eted at the OSGi Platform

Pierre Parrend
  • Fonction : Auteur
  • PersonId : 834268
Stéphane Frénot

Résumé

The OSGi Platform finds a growing interest in two different applications domains: embedded systems, and applications servers. However, the security properties of this platform are hardly studied, which is likely to hinder its use in production systems. This is all the more important that the dynamic aspect of OSGi-based applications, that can be extended at runtime, make them vulnerable to malicious code injection. We therefore perform a systematic audit of the OSGi platform so as to build a vulnerability catalog that intends to reference OSGi Vulnerabilities originating in the Core Specification, and in behaviors related to the use of the Java language. Standard Services are not considered. To support this audit, a Semi-formal Vulnerability Pattern is defined, that enables to uniquely characterize fundamental properties for each vulnerability, to include verbose description in the pattern, to reference known security protections, and to track the implementation status of the proof-of-concept OSGi Bundles that exploit the vulnerability. Based on the analysis of the catalog, a robust OSGi Platform is built, and recommendations are made to enhance the OSGi Specifications.
Fichier principal
Vignette du fichier
RR-6231.pdf (956.26 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

inria-00157341 , version 1 (25-06-2007)
inria-00157341 , version 2 (26-06-2007)
inria-00157341 , version 3 (27-06-2007)
inria-00157341 , version 4 (27-07-2007)

Identifiants

  • HAL Id : inria-00157341 , version 3
  • ARXIV : 0706.3812

Citer

Pierre Parrend, Stéphane Frénot. Java Components Vulnerabilities - An Experimental Classification Targ eted at the OSGi Platform. [Research Report] RR-6231, 2007, pp.84. ⟨inria-00157341v3⟩

Collections

INRIA-RRRT
169 Consultations
179 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More