Full Disclosure mailing list archives
Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
From: Paul Laudanski <zx () castlecops com>
Date: Tue, 25 Oct 2005 17:21:17 -0400 (EDT)
On Tue, 25 Oct 2005, Tatercrispies wrote:
On 10/25/05, Paul Laudanski <zx () castlecops com> wrote:Anyone have other ideas on this? I've already implemented some code to validate file input and its working. But is this the right approach?Since it is an IE issue, you may as well be using HttpOnly cookies. It isn't a perfect fix, but maybe "good enough" for the meantime.
See this thread in terms of what has been found to be exploitable (browsers): http://castlecops.com/p645421-Strange.html
I think the fact that it's exploitable at even hotmail.com<http://hotmail.com>will prompt MS to do something quickly. I don't think it's reasonable to expect every two-bit web script to need to validate the integrity of image uploads. What about folk without the graphics libraries to accomplish this. Are there pure PHP/ASP scripts capable of doing this-- and can we place our trust in them?
If sites want to stay online that make use of dynamic content to some extent the onus is on them to do proper input validation. There are PHP functions which permit for checking. But again, they work well when checking local images. -- Paul Laudanski, Microsoft MVP Windows-Security http://castlecops.com - http://wiki.castlecops.com CastleCops Deutsch - German Internet Security coming soon! _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. K-Gen Gen (Oct 22)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 23)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 25)
- phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Paul Laudanski (Oct 25)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 25)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Paul Laudanski (Oct 25)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 25)
- Re: Re: phpBB 2.0.17 (and other BB systems as well). Morning Wood (Oct 25)
- Re: Re: phpBB 2.0.17 (and other BB systems as well). Matthew Murphy (Oct 25)
- Re: Re: phpBB 2.0.17 (and other BB systems as well). Valdis . Kletnieks (Oct 25)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 25)
- Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 23)
- Re: Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Tatercrispies (Oct 27)
- Re: Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit. Nicob (Oct 27)