ABSTRACT

The methods parse() and format() in java.text.Format contain a design flaw that can cause one user to see another user's data.

EXPLANATION

The methods parse() and format() in java.text.Format contains a race condition that can cause one user to see another user's data.

Example 1: The code below shows how this design flaw can manifest itself.


public class Common {

private static SimpleDateFormat dateFormat;
...

public String format(Date date) {
return dateFormat.format(date);
}
...

final OtherClass dateFormatAccess=new OtherClass();
...

public void function_running_in_thread1(){
System.out.println("Time in thread 1 should be 12/31/69 4:00 PM, found: "+ dateFormatAccess.format(new Date(0)));
}

public void function_running_in_thread2(){
System.out.println("Time in thread 2 should be around 12/29/09 6:26 AM, found: "+ dateFormatAccess.format(new Date(System.currentTimeMillis())));
}
}


While this code will behave correctly in a single-user environment, if two threads run it at the same time they could produce the following output:

Time in thread 1 should be 12/31/69 4:00 PM, found: 12/31/69 4:00 PM
Time in thread 2 should be around 12/29/09 6:26 AM, found: 12/31/69 4:00 PM

In this case, the date from the first thread is shown in the output from the second thread due a race condition in the implementation of format().

REFERENCES

[1] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A6 Information Leakage and Improper Error Handling

[2] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3630.1 CAT II

[3] Bug 4228335 : SimpleDateFormat is not threadsafe Sun Microsystems

[4] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 362, CWE ID 488

[5] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 362

[6] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 362

[7] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.5

[8] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.5.6

[9] The Java Servlet Specification Sun Microsystems