Full Disclosure mailing list archives
Re: Internet Explorer and Opera local zone restriction bypass
From: psz () maths usyd edu au (Paul Szabo)
Date: Fri, 31 Oct 2003 08:41:14 +1100 (EST)
William A. Schulze <was () macromedia com> wrote in http://www.securityfocus.com/archive/1/342910 :
... Flash Player stores cookies in a somewhat predictable location (assuming the username can be guessed), and some of the contents are stored as plain text. While this is not in itself a directly exploitable vulnerability, an exploit can be created in combination with a security flaw in the browser. Macromedia will therefore make changes so that browser vulnerabilities of this nature cannot be exploited using the Flash Player.
I applaud Macromedia's commitment to security, being willing even to work around a security problem in InternetExplorer. Thor Larholm <thor () pivx com> had written in http://www.securityfocus.com/archive/1/342467 :
... Flash allows you to store arbitrary content in a known location ... in plaintext ... can easily be fixed by applying ... slight obfuscation of the contents ...
Storing in an unpredictable location might help. Obfuscation does not: instead of setting a cookie of BadThing, the attacker could set one that will become BadThing. The need to reverse-engineer the obfuscation, and details like possible character sets, are a minor hindrance only. Security by obscurity does not work. The problem of predictable location and content is NOT in Flash but in IE. It is arrogant of MS apologists to suggest, and of MS to expect, that other software should work around their security issues. Will user habits of downloading to MyDocuments (or the desktop or C:\) be patched also? Avenues of exploitation, not using Flash, will be found. Fix IE, or else. Cheers, Paul Szabo - psz () maths usyd edu au http://www.maths.usyd.edu.au:8000/u/psz/ School of Mathematics and Statistics University of Sydney 2006 Australia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Oct 25)
- <Possible follow-ups>
- Re: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Oct 25)
- Re: Internet Explorer and Opera local zone restriction bypass Bipin Gautam (Oct 29)
- Re: Internet Explorer and Opera local zone restriction bypass Bipin Gautam (Oct 29)
- Re: Re: Internet Explorer and Opera local zone restriction bypass fulldisc (Oct 29)
- Re: Re: Internet Explorer and Opera local zone restriction bypass jelmer (Oct 29)
- Re: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Oct 30)
- RE: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Oct 30)
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Oct 30)
- Re: Internet Explorer and Opera local zone restriction bypass Valdis . Kletnieks (Oct 30)
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Oct 30)
- RE: RE: Internet Explorer and Opera local zone restriction bypass Jerry Heidtke (Oct 30)