Re: reverse engineer c or java

[Michael.Wojcik () MERANT COM (Michael Wojcik)]

> -----Original Message-----
> From: Crispin Cowan [mailto:crispin () WIREX COM]

> Agreed.  The buffer overrun issue for Java is that the JVM is often a C
> program, and *it* may contain buffer overrun vulnerabilities that enable
the
> attacker to write bytecode that exploits a buffer overrun in the JVM to
> obtain privilege.

And, of course, that even a (hypothetical) JVM free of implementation errors
like buffer overflows may contain design flaws that either do not implement
Java security rules correctly or fail in boundary conditions (like illegal
opcode combinations).  We've seen more than one exploit of that sort.

Java's a smaller target than the huge number of unsafe C servers out there,
but it would be a mistake to assume it's safe.

Michael Wojcik             michael.wojcik () merant com
MERANT
Department of English, Miami University