Confusing the JVM about types

Ravindra Rao (rnr@hpcf.cc.utexas.edu)
Wed, 22 Oct 1997 14:32:34 -0500 (CDT)

Date: Wed, 22 Oct 1997 14:32:34 -0500 (CDT)
From: Ravindra Rao <rnr@hpcf.cc.utexas.edu>
Message-Id: <199710221932.OAA04820@spica.cc.utexas.edu>
To: java-security@web2.javasoft.com
Subject: Confusing the JVM about types

-----BEGIN PGP SIGNED MESSAGE-----

Hello java-security,

I have appended a uuencoded file containing a demonstration of a
possible security risk. The risk in question can be loosely classified
as a 'type confusion' attack. I do not consider this a bug. I believe
you will agree with me that this is an unavoidable consequence of the
type system of Java and the way in which this interacts with the JVM.

This example will be presented as part of a tutorial on java security
at upcoming Usenix conference in Monterrey (December 8 1997). I wanted
to demonstrate the importance of protecting the JVM from malicious
classloaders. If you feel that this example is inappropriate material,
I will be happy to consider something else but I will need to know
soon.

The uuencoded file contains all sources, makefiles and a full description.

Many thanks,
- --
Ravi(ndra) Rao
Systems Group
Texas Advanced Computing Center
(512)475-9483

PS: My pgp key can be retrieved from <http://pgp5.ai.mit.edu>
- --------------snip-------------------------------------------------------
begin 644 confusion.tar.gz
M'XL("/1+3C0 V-O;F9U<VEO;BYT87( [3W]<]LVLOG5_"MP3F\DY6SJ6YIQ
MSKU1%>?BOGQT(K<W??<Z'8J$)#84J1*D'5W.__O;70 DJ(\H;F7EBYB[QB*!
MQ6*QV%WL+D W"B>I\*.P_IWC#9_;OSG7SH,]EV:CT>MTV /&6JT&_<OZ/?DO
MEDZSWV*LUVFU.YUNM]ECK-GJ=9L/6&/?B&PJJ4B<F+$'<1B_M]YLX4X.@<^!
MBS]?1''"<-IM/[(?/;;,)VGB!_C,6J3CP'?9Q ^=@+F!(P0C?F'\;<)#3[ A
M/GL>.1Z/K7<68\\<,4N<<<!E;?GG.0OY3?ZJ6@/(C-7K[&KF"P;_2V:<+0+'
MY6P21W-V,_/=&3R$-[+/@#I@-WX0 "ZQ2.!)]$;"F$2QJC7Q RYLQB[9S+GF
M; YMF)\0<.',.7/,CFYF/.;L4L)XP_F".0!\OBS LFV?4YMK)T@YBR;J1^S3
MN(;/!Z/1ZU>OKB04/Z37+YPW')L#)A<>]A\QD?J)#946L7_M))R-DM@/ITQP
M-^;)#X3/.3NN(Z_5TV;==>N1J -GUJ\;]<2=U0DG+HZ);FI.:!ZJ-0N7TCM+
M+BF1+GB,Y,4?MT3D1X_PQR/VFCL>8 C(."%SXMA9XG#&RX1+JKA1"#.:"#U(
M' &;^M<\A$H2A+-8P)PCXB\'+RYP7 X3"^[ZP!M$5)O],+AZ1B^=T&,PMC1&
MFCB)[-'6J-#S2I@&087Y$]D73'88)4 B+@ /(!XQQYPGLTB#$JJ-!).&,$7
M(3!OW&/I(@H1)605.7O +LF,A3#ST([X=%!AP"SR[V%%8E,WI@6I\>]?H#,@
M+=9Y"F"J:JX03I'8@'CU+U5\;O/?4R<0U6/9RW&-_?>_;/W%\+A6JUE'BBPX
M$II/+$F\M([>64=,XT S/DXGC_$9XL'R/R_#19H 6MR9 ]7HL4)RX20S[!>X
MR>2MOP%O'<-_Z17\L DZ<M.1',9F7/$M#O=(XCA:BH3/[2A-;"!8F 1A]1A7
M/G8LVS0E8%@VR$$H4*!%;!_7'FL8'XA@,\/P2'$R_#M1<H1F10.2H'$,$YN_
M]44BJFN( QOE+0WBF4!T74UWU8)FHPJ#K4WL@(?39%:M_9*-!IZS4"ZA<^C%
M1L:I:@CYH.&-&T2"Y)Y^A$27+?]RSG+8@/H*?Z@&\N$:\%O\AP>"RY^%ID>W
MBKE<!V1(]>*MRQ<):'R0W37%;)OJWQHR1BQ#=Q9'H?\?6&'#3!337^;".&'C
M* HX2!98O5%PK59* FUOA%0I@1-.;6KX,DJ>1FGH90@I- $CV86+Q%>CQ[^K
M]+AF:!1[RI-J-G-(3*@G&]'DJZDOK"4U3<7%79A]@F/4-0 J_(XVK '-LV<,
M%P,#HPJ(XO&)DP:)4ERT &@HH$@]"4/2,&?A;#;-^;Q;IZ01\KX !S_D>3\G
M!B%.6,/\J?A/-LVI#"M%MUQ!\E:1/9MN8B;Z6W;H$E45?[F/+=WVUOK8ED]9
ML+B9_3^LWU<?K-/J]_M;[7\H#6W_M_N-/MC_S6:_\8!U[PLALWSE]K\Y_U)Y
M[W\+B/N_7F_[_+>!.7#^81_8;K6!%YKM5K==[O\.492"EYL=R0"T?UO9H:#T
M-S<=LN;*KD,9=,IP),N=HYX-V MW&"WMX\=KAL5UY'OL2729K(#:9&-BM3.F
MS</:.C"%:Q+)/U9 :AN'1E(J(57,]:\WK/ON8^?Z1Y^/DO^]?@?]/_U&KUS_
MAR@/K8=L&,T7N+-,]'*]YC&R!+H Y%I6AN4T3$_GP"06MAIQP\7AP8Z+/# .
M@W6["%!TT'Y_&:6P[X"]AH>>CX?6Z-G%\^?G];$?UL7,LF#/?J;ZD%L]R_JK
M_./LKZ2(K*-OW@V'MPS^^_3YX)\C^@O=+>AAP!]/+E_K%W\OE_.=RZ;U3[.Y
MQSYVK?]>LY.O_T87]7^O4^K_@Y0/6__K"W<X/,?EZ5IR69Z?3MFIQQ<Q=QW:
MREN93_2\#C(@KJ./I9Y$VH5Y=/2073RYO&)7K]CHQ\LK6?]B!,OY7*UP; SJ
M_?O!3P/U\CR#0E[;^F_>F[HOZGX(<XC.OWK@CW4']G_\Q6H?EA86YZ>>EB/4
MY:V5R93S4P* '3'[K% )?AG(W'X1TLM8_\W[V@#>8?_7Z;=Q_3?)_B_W?_=?
M"O-_3QO 7?*_T^QG\]_MD/QO=UJE_#]$H;C0HT( ;@)FP+H*L"V,D=S?=K&)
M 3L5*2!+4EF>(.EAT\:YQSTV7LJG@WO:2GZ%^\'"^K^G#>#.]=_.[+].#V4!
M[/]ZY?[O(&75_MN\^"F,ZT:+)<;1*7B<!=,]'VR^)(J7 $@%U@LVY#A-\@"L
MCKFJN%[E0S:$1^X"#*6188?5S?=%.ZY>@']G<VSTT>VQ0Y>-ZW_/&\ =Z[\)
MYEZV_IN-)NK_?JM<_P<IG]KZ/]R^<K3E35TF).QWXSG:NO/4W>UI UI*R[+<
MI>3R_\G%:/CZ\H>KRU<O]]S'#OG?:63RO]7K4OROU>WW2_E_B +;KL%8)+'C
M)F>61=O A>.^<:8@V?D\"O$5)L%@LF"2P!L6R>S&[W]Z(3W\$Q!"0N4\6E,>
M\AA31*'1%)0"JA"''2?+!6462E8[IMQ,+Z(\/W@J?$SJI#1/!_3%U/+S+F C
MJ'YA@HH;>:2=_(G/XQ,&J,VREA([P?E<8/[?F%L. >>_ISQTLZ1-T%X\7@3.
M$FHD-YQ+X)0CXR=*Z3F,$/9#ZWN0@Z3\I%X349#J2EK<PU@2W#H+0"M*!8!U
MG510QJE&QAISEH8.[E IG\:RK);-+L,DCKS418! >PD%-L#"QYQ2&()+Y(<*
M@% A_Y7H3DFPE.4(!(I"3CA;:2@K<#9-?4&C=H#,1"9XKX*RBSB:QLY<31MT
MFVMQ8];E*Z@+^,QERY@S!_Z?W$28MX>8&S B-YUCRJ9U17FCF)ZK*C$QPP0P
M0DMQB$SHC()HNI2INWJP%,(%>)::41EZ<MC<@5T^4=BDA<X/E=U!$SY?($_Z
M@9!X 81S)]&!&9&Y,:+B00:*F%T0R_I_T N :QXC<E,'F8Q A5@>)*#)HY+
M<Z\=)R)UX8&8I '2XUCQ>C@]IF4!G*PH?Q/%7N$UM 6</.:E7&;2!K3(D F!
M0=$9@DUD:X2C\V/1R J6:E%Q[P3Y;>Y/9PDTTRV)3WSBJW'@ V=XUGA)@TLE
M:QA# 9YLVX3B=X[ 8+H[@^$"7PY"3/@%VI,!1JX8D3'DJF4WJ*BD;60*#+?/
MP"9T+%BN@:??;&\]K, X!T( &ZFI<"AMV\J 8R@1QC?!O$'LP\DYUP ?,J[F
M2B[ZW+AB/+SVXRBDESI_&SN5&$F>.F'$Z"JAN$+I=)432\^43BZ&[C.\^%ND
MD)_ C)R>GC)^37(E2J<S+5XP#= R.H&92P./$@$S,(#(R^CFA %GN%PEV-,R
M'W/=M:6RZRA+78D@X(4)( QMR$6FH9VP&TX$$^DX\9,4%C08S"RZ"2W#P,^S
MH*7TQ\K $^F4RU6$V9#9,+V(2^[+5X,3+G,VLJU+*4]=1^C4^F)CLV'>CM+S
M*;$[2A.+I'=!$LK5!8LKP,Y 8X>)CP(*)3-_RUT<FZ-SQ*.)A2@<CQWOF&T;
M:;[)(2;+!D8] 1U1RF$JO..'W-,J2(M-X$>MR\A2KA B:J#J";&'70^C;)#;
M.]YWI[BN"MW^$'"<$-!' '\^I_Q^!5X 3]#Z_]B62%D^1LGM_\N7HZO!\^?W
MT,<.^[_5Z&?Y/]TVQ?]:S7;I_SE((9F?VWPHE\@B%^H$$!AZ"R=.A#)?I)F%
M3TZDOD6MJ!0E2I/*-(J\2N[\X0'I,V7]26W.#"M&FR_:+M$&',A\/'.$>B&S
ME:1%IA!19IW$1") 4K\"4C_K_Z0H7OW0!"8109D<,>7(64'_S#K=6BP+=DY#
M](A5"E[3BC3BZ"23-B!TA0J9_2C%_6D:XXZ&TJ(0FP(,-42DO391:$N#E5%'
M6-;H\NKB5W0%/7OUXN*\GHJX'D3071W5 'JGFG;3[NSRE:W T?$_A$2,(/4W
M9G#1.;K,VT4'.5#[Y!T4#^_)ADA0[!8TDO3VJ>-8U05M>\A8L9(U_JN1&A1@
MTG%E]M+ H;JARS6]R&B5I^M63^=5$<N:D ')[*A>Q3AN5-&[5A!"-&&5_ PL
M:LV.K5VC%NRK_+??,DQ^8X9*MZPNV,P1B]-05CE](V;?HC6(1RASEYY]]O<,
MM_53@]\:38FTF:*W"MRYQM_O8U#BT9$Z[H@;K W+D]/)&Z U7[!.;C^#Z;UU
M\ 73HK09/ON2Z__[RO[=??Z[U<OR/UK-3HO\?Z7^/TQY^/ AJ;&87 >@DGU7
MIO=>H?\ICPL5_$_\K8/;N/7HC19\.HBC?V^)Y5 :,1X<GDCM'T=@$D@/EA1&
M) W1P:)5CZ4#*\\N1SJZ@FG%JJ,/U(N;.]9"$NR1N"+,\]\[>C74[*Z3V[+K
M)X;/0FO*%25IZ,"5CC;$LO3H=T6TL.__]1?*.I$;36T+&</5&A3HQ= >B?TQ
M>3US1,S0V#?O"E2_78V%R6Y1C5=.0?=$\NRI"B'2!"L^BPUW&CE-UJD$@$B-
M%6EEV!.L0HQ7V4R_[>F?FH+%&F88S1A&%I^[RV@$)V^4-JZ0I\B1%+TA*R22
MGB DN3D3H+MO.'"'HQ_DF5!HN#QD;AK'Y$W)770K_'+7F"(.\RGUA:X".3AD
M4&4T*.Y8M=I0%KP>GN<&E/7JN^_53Q5=?'+QXI5FFA?1-2?7FY%)-C!_# L_
M5(22_9]UE#M!)%A$]S6?\_E8.SQ7D97 6<Q_3X&C=$1;1-*@$6B)8SOB+3E?
M@+X?D(U&GO,;=*037TEO',YP $M'^>G ^+R)P@HY7K&1G%F:3B.ATB9,!\&-
MLT39@F>D193MB6)U[P'[/>6"6,H91Q@Y)S%8%$7(VB;+$];2"Z:L8QP8]J=8
M-F?"@NM)G<IVM&/,$4EV%!LC\X:=>Z8PGKMNM)0Y M^\@PF^M8Y<SS2('[-O
MJB\&_W-1^["^8< \.XZ.[JQBS D@W'#G3<B%P.$4;,_WHU2H:B"UAA7E*BB6
MD&$53FL,*A+D,P(WW#2N]^1*4DQ("0)UVP9&: JY$C*HA%O2A:\KK6=5%'(J
M%)X@C9$RZ#S'5UL2*Q UA7W30)^H)I\7Y,!C7%SQG)U.,"T]7ZJWZU6E-L6#
M_(^9;&&N<UE]5 M:VW.E&>?2ZK\%UG6[?]]G_[9'?]OMG7^?[/5QES09KO3
M+^]_.DC9K_V_,WMK?Q;_@4W]G:ZT/V37;S/H#V#)?VXF_';;_4LQVC\I:[TT
MUK\&8YT.<W]2EKK$Z(^;Z2LC^JQL=(E[::"7Y7 EM__1XOD5YG#_?>PZ_]%M
M=;7]W^OTVNC_;_7+\_\'*2IY,K<B*0<W]OD$)+QP8W^A]92^#%206/3#">:[
MQID4]"F'D&ZH-)XN\S/>[$D.;SUN:=0S(YB:*=F&<J5O)\4(->I9O-(/C&"Z
M=E*-RK946LLF .P9YACF\56ZJQ0CN48J_%H;8Q34P F=8"G\S-36Z;*6E5M7
MFW'?G- *FZB-N*K>,[H:1G]N<:B,3\&.,=![;%O#YAY@82(=C$<["#;!RM[A
MSFJ^!&,KP;3*X>N+P=4%^_G5CZ_9JW^]9#]=O!X!46VK>'%,L:APOD\Y#[#=
MP42_I<I<+"13&*;,APU.LJ_*NT,C4*6?8")(T6:Y,[0"J(^]J.]0<OEO4'//
M%T'<Y?Z_3I/._[?P_$=Y_\/]E\WS;R25[J&/7?J_U\W.__0[=/][M],L[W\X
M2#'O?R@>@E$[\=TIWYOOA1C0O1#9M>.OQK_A"8QKVCJ#7(^Y3!4S+G>GS9*6
M\VJ_ILX]$ BIT\R=G-&87(:&V5&Q[3H=)[C2J> 2B&Z]L7[3O O<O+D";ZY=
M>3:HZE?KMX&;EQ#C[='Z^@M]_:V\V!>QM_&"7G?],@O511%TUF =9O&.=YK-
M"I@R%1SG;RF>C)%;4+189HXXH0-,0&O!3W!R9_+>1-1C. L2"KGI"$B66)^?
MH"(E67F=AB%Z432AJ0\\;<(!H+J='<\MD,]D#O\):+/LZ*3V.9D<47C-0Y\.
M::'Y4/14$9!%&B\BD25_FBU\I8*![F@'>MSU/3HSP-\NP$)%AI4PQLN<A;6K
M-!^ ,2I$]H2 24\1)C\JBD3J,N4UVJSQ#=U& A4^X#(2J*4.\0Z.,Q9Q;7F5
MR7U?3;)%_A=.&OS9/G;(_W:WJ_=_[7Z3[O_IM9KE_N\@Q93_6C:2WY3\?K!2
MU]V-\DH>RA3&I9!;Q)82&BXEJT:L G+JDD[K4*ZM]GNJM%[IW-.G)96V\04"
M46><8',E;TYG":QCEN=MZUO5S>-4%&!0CCA?=8JP2!2I;82G3H?I]X::(RB4
M(BZ[J8S=0)UE0RAT:"T[9L7DUS-,,,GZADX=4(3FDL)<TA2AJP8;:$M46H!2
MPJC'NF;-$H/?&9?S)R IE<29PTSH"_F=>"K^_4OA!G[J<.W>_1-V&01\Z@0#
M.L.8/[>,+=!E=NP*WA2O[-?"K5[7VS63,ANIHEK((VY :J74U+=,M! D=)7N
M51W\*+;068E\?0J/V$9_AR-O7G$KVJ6\,H&2P-)%6P&FCH$)%Y'\S$D2Y1 T
MS#6.R4)O\ +0(0:RM32'\<%O._]H@@9SPI(XY;4-'P"!OGX&TVN<!19DBW_(
M=ZK&D#0AG2!FU.59=@P3%S%QK YTZ8-XJJG"/T=^,_O*3ZV<%=MN![Z1+(*T
MGFJ[8?':A3$](_VKA(P\@(RV L[;KQ+ZK_GJ&6!/.@ZC *BS)5@'/?J9-#%7
M=F' JIW)34AV#6"-4OHXYUHS$&S_0F-D1I_($9EQ4G%M0Q96:W)Z='NY9E;X
ML3"9&75ES R .[%@V8!)%O,)]HM'G=$ 4A(&6DU#;;5G1PI=$#FX6( R(B>;
M.M@O,P%R2#3-(IMGDQN4'%?M 1H0)3M8: J[34$K&PI:]#3Y:BZ=["L?@QI;
MH1E]>,*QR:9:^ZC)!DF:?]UDD]$U-/,9LNOF!G@?'?N;=71TE L@&UZ_!,,V
M_ZP/?G:$_I8?O*K6)'+\K80_PG/K5[&CL+Z]9Q/N3Y7-]M]^<X%V[?];_7;F
M_VGWR?YK-#JE_7>(8M[_9'A]LCLOS*/_&RX!E]_FTLY?\B$(?QK*4_+C[ @<
M?<U-WT.155>!?)#OL%,#G2UX(O)S7#(=0*>^G!C)[X2<D09AJ]O(5T_B;;J/
MW _=(/4XW4& F0$\03-6(![&V2RQX:KR+^W&XS^6;X)I(R:?%'>*E$92S ]9
MR0"15U:I^'\98O[HY?WR?S]][+S_O9-__Z&)WX)I=ANM;BG_#U'N(/^_-H'_
M58BZ?/T7XI][C0#>Z?[W;D-^_Z%9QO\.4;;-_SXC@+ON_VAV&IG_M]NA^%^_
M4][_=Y!2N/]=AT>T%S6+\SP%.2O#)"B)49X+IF\D\/R)<HO:VL^)7LC,;5.Q
M5\()%3;S42"/^<PG+4.Q.-T77BLAPT8B2P*AR\M4BB7Y<C*W$\I]D/")O&PD
MO\\/'0L(!M$=.UXAQ=BX:^QG]76B)%X6?4U<?^_XT0<&C;*K" %:3B[IPJW7
M-X1'36IK@-:F.*I940,VW;]EA+*,4!XN0IG?$I)S^>&CEF795]FJ__<8 =ZE
M_]M9_F^GT>TW*".HTRCU_R'*IOCOW F=J;QRRKQX45^T2)(%U[DI=G7L=^W6
MQ3PX-*Q\QA'-#PWWEH'-M< FP*:B-9F,\NA?-3!&BH$>:*.;(.FN9IC7775J
M.O1C#%K%H?ZAPF[9[[P*!A,+9[;R4!KY*[+@H)?&>K X&&4=2" ZU<RT:T'1
MCR)Y'UZP/"ETH5+ ,PKF@,SDA-P4W1 U)2*?K$0I<YXL1!Q'=!5>L,R6F;QT
M-T"RX2W78,FNC+*($'&XOB,5V BS\=_'0]#EBRCFT77&[03(2<P+LLFH,I(H
MD"C7/H[1,0WRXKVL$IJV*R2?Z%\;^40VR(*"I=%QY[)-_^_3 [S+_]MO9=]_
M:3?H^R_==J<\_W^04L;_[N(.UL)(.83?[QS.*IN[^4_-5[QM_1=&^B=Y;-?Z
M;[74_7_M9J?5:%/^9[OT_QVD*/O_1Z$_NR ]).2149]ET(X,V[;7'3&YGP'!
MH#:G\_-X]MC.?2^FW9^[,0K>K-P=\;C4X(<KN_3_/C* =N7_-'K-3/]W\2Q0
ML]=NE_G?!RE_5O]KY:J5NJW.;^8W0Z\HZS*Q9GMBS9=G7I2E+&4I2UG*4I:R
.E.43*_\/35DTJ "@ "5

end

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBNE5UvCtiCEKC3qO5AQHUtQP9GY/u75jY9NZA7Fsn4xDUY9EF5g5j01bq
AzCLI+saabt5dR2+X5HNyp+wYPubalVQ6zWFi/0wEcjWeJgWZIysP8JmvVTD9SfV
bWdtWXZCiIVBw8hfIgeM4+/9k7/2CDDOn4pjSNfGLOv0nRWq8aREm9SFxzyOoxu6
P2hVpu/8xAU=
=H4Jp
-----END PGP SIGNATURE-----