Full Disclosure mailing list archives
Re: Internet Explorer and Opera local zone restriction bypass
From: psz () maths usyd edu au (Paul Szabo)
Date: Fri, 31 Oct 2003 08:41:14 +1100 (EST)
William A. Schulze <was () macromedia com> wrote in http://www.securityfocus.com/archive/1/342910 :
... Flash Player stores cookies in a somewhat predictable location (assuming the username can be guessed), and some of the contents are stored as plain text. While this is not in itself a directly exploitable vulnerability, an exploit can be created in combination with a security flaw in the browser. Macromedia will therefore make changes so that browser vulnerabilities of this nature cannot be exploited using the Flash Player.
I applaud Macromedia's commitment to security, being willing even to work around a security problem in InternetExplorer. Thor Larholm <thor () pivx com> had written in http://www.securityfocus.com/archive/1/342467 :
... Flash allows you to store arbitrary content in a known location ... in plaintext ... can easily be fixed by applying ... slight obfuscation of the contents ...
Storing in an unpredictable location might help. Obfuscation does not: instead of setting a cookie of BadThing, the attacker could set one that will become BadThing. The need to reverse-engineer the obfuscation, and details like possible character sets, are a minor hindrance only. Security by obscurity does not work. The problem of predictable location and content is NOT in Flash but in IE. It is arrogant of MS apologists to suggest, and of MS to expect, that other software should work around their security issues. Will user habits of downloading to MyDocuments (or the desktop or C:\) be patched also? Avenues of exploitation, not using Flash, will be found. Fix IE, or else. Cheers, Paul Szabo - psz () maths usyd edu au http://www.maths.usyd.edu.au:8000/u/psz/ School of Mathematics and Statistics University of Sydney 2006 Australia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Internet Explorer and Opera local zone restriction bypass Thor Larholm (Nov 01)
- <Possible follow-ups>
- RE: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Nov 01)
- Re: Internet Explorer and Opera local zone restriction bypass Paul Szabo (Nov 01)