Incorporating known-vulnerable JAR scanning into RHQ

David Jorm djorm at redhat.com
Thu Nov 1 02:10:17 UTC 2012


Hi All

I have recently been working on some tools to identify known-vulnerable jars at build time. Details on the whole tool chain are here:

http://www.slideshare.net/davidjorm/tracking-vulnerable-jars

Part of this is the victims DB (http://victi.ms), a canonical database of known-vulnerable jars. I recently presented this material at a security conference, and one attendee who is a big RHQ/JON user raised the suggestion of incorporating this into RHQ. The idea would be for RHQ to (optionally) synchronize the victims DB locally, and use it to scan deployed user applications on all the servers it manages. It would then (as per configuration) trigger alerts when it finds a deployed app with a known-vulnerable jar in it. Once this kind of feature was in RHQ, you could easily plug in a database to identify code licensing in jars or other things.

I spoke to Charles Crouch about this and he mentioned that RHQ already has code to scan dirs and collect md5s. That would just need to be modified to collect SHA1/SHA512 checksums and compare them to the victims DB.

I'm currently working on refining the mechanism used to identify known-vulnerable jars. Rather than relying on complete jar checksums and metadata, I want to do partial contextual hashing of the jar contents. Once this is working we should have much more accurate matching of vulnerable jars, and I imagine we'd be able to demonstrate something like "1 in 50 user-deployed apps is vulnerable" - probably even more than that. I don't think we should build this feature until that refinement of the mechanism is complete on my side, but I wanted to start a discussion about this anyway and see what people think about adding this feature?

Thanks
-- 
David Jorm / Red Hat Security Response Team



More information about the rhq-devel mailing list