Bugtraq mailing list archives
Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product
From: "Jason Coombs" <jasonc () science org>
Date: Thu, 18 Aug 2005 15:21:58 +0000 GMT
The following script error message was noted being displayed this morning on an airline check-in kiosk manufactured by Kinetics USA. Vendor: Kinetics USA www.kineticsUSA.com Line: 107 Char: 2 Error: object expected Code: 0 URL: http://151.151.10.46:64080/attract ?time=1124376480&TransactionID=HNL_KIOSK09-050818044716 Clearly, building a product such as a publicly-accessible airline passenger check-in kiosk using Internet Explorer and Windows is a very bad design decision if you care at all about preventing this sort of information disclosure. Even so, IE can and should be configured so as not to display such script errors. Furthermore, the use of an IP address that is outside of the RFC 1918 private subnet address range appears very irresponsible. Sincerely, Jason Coombs jasonc () science org
Current thread:
- Sensitive Information Disclosure Vulnerability in Kinetics Kiosk Product Jason Coombs (Aug 18)