Penetration Testing mailing list archives
RE: C# Exceptions
From: "Krpata, Tyler" <tkrpata () bjs com>
Date: Fri, 25 Aug 2006 18:27:01 -0400
It seems like you're saying that the application makes requests and receives replies from a web service, and that you were able to crash the application by sending invalid replies? In this case, maybe an attacker that was able to launch a man in the middle attack could exploit the application that way. -----Original Message----- From: 3 shool [mailto:3shool () gmail com] Sent: Friday, August 25, 2006 2:59 AM To: pen-test () securityfocus com Subject: C# Exceptions Hi, I'm testing a C# desktop application. During my testing so far we have found security issues that lead to application crash with following type of errors: 1. Acess Violation Acception 2. Null Reference Acception 3. Invalid Object Acception 4. Application crash dump Are these issues really a security threat for a desktop application? We got these errors by sending junk data over the network replies that this application gets from its web services. However I fail to understand the security implication and risk of these exceptions. Since this is a desktop application and not a web service or server how would these issues impact the security of the desktop application. The application doesn't open any port on the network for incoming requests. What would be the best strategy to test such application? What would be the points from where attacker could attack such a aplication. I'll really appreciate some enlightening thoughts on above queries. Thanx in advance. ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- C# Exceptions 3 shool (Aug 25)
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- Message not available
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- RE: C# Exceptions Patrick (Aug 26)
- Re: C# Exceptions 3 shool (Aug 27)
- RE: C# Exceptions Patrick (Aug 27)
- Re: C# Exceptions 3 shool (Aug 27)
- <Possible follow-ups>
- RE: C# Exceptions Krpata, Tyler (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- RE: C# Exceptions Steven Scheffler (Aug 28)
- RE: C# Exceptions Patrick (Aug 28)
- Re: C# Exceptions 3 shool (Aug 28)
- Re: C# Exceptions 3 shool (Aug 31)