Java反序列化漏洞探析及其修复方法研究  

Analysis on Java Deserialization Vulnerability and Research on the Methods to Fix It

作　　者：徐江珮 王捷 蔡攸敏 刘畅 XU Jiangpei;WANG Jie;CAI Youmin;LIU Chang(State Grid Hubei Electric Power Research Institute, Wuhan Hubei 430077,China)

机构地区：[1]国网湖北省电力公司电力科学研究院,湖北武汉430077

出　　处：《湖北电力》2016年第11期47-50,共4页Hubei Electric Power

摘　　要：为避免利用Java反序列化漏洞影响企业核心业务、产生重大信息安全事件,详细介绍了Java反序列化漏洞的背景、原理、漏洞利用方法及工具,通过一个具体实例给出利用该漏洞进行服务器主机系统提权的详细步骤,并提出了多种漏洞修复方法。In order to avoid the use of Java deserialization vulnerability to influence core business of the enterprise,to generate fignificant information security incidents,the background,principle,exploit method and tool of Java deserialization vulnerability are introduced in this paper.Detailed steps have been given through a specific example which exploits the vulnerability to acquirethe privilegeof a server host system,and a variety of methods to fix the vulnerability have been proposed.

关 键 词：Java反序列化漏洞 漏洞利用 信息安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]