Re: Files upload security considerations

["Cleiton Martins" <cleiton.martins () gmail com>]

Coments inline,

On 11/9/06, Alexander Berezhnoy <alexander.berezhnoy () gmail com> wrote:
> Hi!
...
> Namely,
>
> - Ways of file delivery  (HTTP POST, FTP, e-mail)
Usually HTTP, but depends on your current environmnent and policies.

> - Main risks
Remote command execution, Disk space exaustion (DoS)

> - Mitigations
Store files in different partition and in a folder that is not
directly accessible (and write code to serve them).
Limit file size and files per user.

> - Formats (JPG, GIF, PDF)
They all have historic vulnerabilities, you should stick with what is
easier for you and your users. I would leave PDF as a last choice.

> - Signatures
Meaning? Should users sign files?

> - Known and historic vulnerabilities
Too many to enumerate.
> We use Weblogic and Struts.
>
> I realize, that there is not enough information to make any decision,
> but, at least, there sould be some common considerations and "best
> practices".
>
> Thanks in advance,
> Alexander.
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> It's been reported that 75% of websites are vulnerable to attack. That's
> because hackers know to exploit weaknesses in web applications.
> Traditional approaches to securing these assets no longer apply.
> Download the "Addressing Challenges in Application Security" whitepaper
> today, and see for yourself.
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
> --------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: Watchfire

It's been reported that 75% of websites are vulnerable to attack. That's 
because hackers know to exploit weaknesses in web applications. 
Traditional approaches to securing these assets no longer apply. 
Download the "Addressing Challenges in Application Security" whitepaper 
today, and see for yourself.

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
--------------------------------------------------------------------------