Java

Java is a platform independent programming language developed by Sun Microsystems. One popular use of Java is to embed small applications (known as applets) in web pages. Applet bytecode is contained in ".class" files downloaded via the network. Once downloaded the Java bytecode is executed by the Java Virtual Machine in what's known as a secure "sandbox" environment. Any attempt to access a resource outside of the sandbox will result with a security violation and the program will terminate.

The security of the sandbox is maintained by the bytecode verifier and the security manager. Bytecode verification is performed before instructions are executed to detect illegal or malformed instructions which can be used to leave the sandbox. The security manager monitors the instructions to prevent the execution of any privileged instruction. A privileged instruction is one which can read, write, create, or delete local files, establish connections to servers other than the origin server, load libraries, or execute native code using native methods.

Even though Java was designed to avoid security problems, bugs have been found which allow applets to circumvent the security system. The following is a overview of some of these bugs:

• Netscape versions 2.0 and 2.01 can exploit Java to create an applet that deletes a file on the user's computer. This exploit tricks the Java interpreter into executing arbitrary machine instructions. Reported March 22, 1996[17].
• Java applet denial of service attacks can hog system resources such as memory and CPU time.
• Netscape 2.0 can allow Java applets to connect to any site on the Internet. Using this exploit, applets can unknowing to the user, send forged e-mail messages, connect to local services that are normally secured by a firewall, and collect information about local network topology and name services. This exploit involves fooling Java Domain Name Services lookups. Reported March 1996[17].
• A bug in the Java bytecode verifier can be exploited to bypass the Java security manager. Reported March 5, 1997[17].