Source Code Analysis to Remove Security Vulnerabilities in Java Socket Programs: A Case Study

TL;DR

This paper analyzes a Java server socket program to identify and fix five critical security vulnerabilities, demonstrating solutions that can be adapted to other languages while considering performance impacts.

Contribution

It provides a detailed case study on vulnerability identification, impact analysis, and generic solutions for Java socket programs, applicable to other programming languages.

Findings

Identified five key security vulnerabilities in Java socket programs.

Proposed generic solutions to remove vulnerabilities with minimal performance tradeoffs.

Used Fortify Source Code Analyzer for vulnerability detection and analysis.

Abstract

This paper presents the source code analysis of a file reader server socket program (connection-oriented sockets) developed in Java, to illustrate the identification, impact analysis and solutions to remove five important software security vulnerabilities, which if left unattended could severely impact the server running the software and also the network hosting the server. The five vulnerabilities we study in this paper are: (1) Resource Injection, (2) Path Manipulation, (3) System Information Leak, (4) Denial of Service and (5) Unreleased Resource vulnerabilities. We analyze the reason why each of these vulnerabilities occur in the file reader server socket program, discuss the impact of leaving them unattended in the program, and propose solutions to remove each of these vulnerabilities from the program. We also analyze any potential performance tradeoffs (such as increase in code size and loss of features) that could arise while incorporating the proposed solutions on the server program. The proposed solutions are very generic in nature, and can be suitably modified to correct any such vulnerabilities in software developed in any other programming language. We use the Fortify Source Code Analyzer to conduct the source code analysis of the file reader server program, implemented on a Windows XP virtual machine with the standard J2SE v.7 development kit.