Full Disclosure mailing list archives
Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
From: "Geo." <geoincidents () nls net>
Date: Sat, 6 Oct 2007 12:43:16 -0400
----- Original Message ----- From: "Thierry Zoller" <Thierry () Zoller lu>
What you call for is in essence - mitigation, yes it's fine to mitigate a "vulnerability". But shouldn't we be concentrating on finding and fixing the root cause instead of trying to mitigate the problem in (hundrets) of third-party applications ?
If the application is what exposes the URI handling routine to untrusted code from the internet, then it's the application's job to make sure that code is trusted before exposing system components to it's commands, no? In this case how is acrobat reader any different than telnetd? If telnetd exposes system functions to untrusted users (no password required) who is supposed to enforce security? In the case of acrobat reader, it's acrobat exposing the system to untrusted sources and it should be that application that is responsible for mitigation of attacks via those exposed interfaces. Geo. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Juergen Schmidt (Oct 05)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Roger A. Grimes (Oct 06)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Thierry Zoller (Oct 06)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Geo. (Oct 06)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Thierry Zoller (Oct 06)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Kurt Dillard (Oct 06)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype terry white (Oct 07)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype gjgowey (Oct 07)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Glynn Clements (Oct 07)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype KJK::Hyperion (Oct 07)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Thierry Zoller (Oct 09)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Gregory Rubin (Oct 09)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Thierry Zoller (Oct 06)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Geo. (Oct 07)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Lamer Buster (Oct 07)
- Re: URI handling woes in Acrobat Reader, Netscape, Miranda, Skype Roger A. Grimes (Oct 06)