DMCA
Security Flaws in the HotJava Web Browser (1995)
| Venue: | In Proceedings 1996 IEEE Symposium on Security and Privacy. IEEE Computer |
| Citations: | 9 - 0 self |
BibTeX
@TECHREPORT{Dean95securityflaws,
author = {Drew Dean and Dan S. Wallach},
title = {Security Flaws in the HotJava Web Browser},
institution = {In Proceedings 1996 IEEE Symposium on Security and Privacy. IEEE Computer},
year = {1995}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The growth of the Internet and the World Wide Web has led to demand for Web extensions, such as the ability to run server-supplied code on a Web client. We examine the HotJava Web browser and the Java language in which it is implemented. We demonstrate several attacks that compromise HotJava's security. Some of these attacks are made possible through browser code that fails to enforce access permissions, but can be easily fixed. Others point to underlying tension between the openness desired by Web application writers and the security desired by their users. We discuss the interaction of application requirements and security needs and suggest how they can both be accommodated. 1 Introduction This paper describes several security flaws we found in Sun's HotJava Web browser and attacks that exploit those flaws. We have implemented denial of service and man-in-the-middle attacks. We have also found that HotJava applets can discover some potentially interesting information about the machi...
Keyphrases
hotjava web browser security flaw world wide web java language several attack interesting information web extension web client access permission server-supplied code several security flaw application requirement hotjava applet browser code security need man-in-the-middle attack web application writer
