Full Disclosure mailing list archives
Adobe Omniture: Cookie-Forcing Issue
From: Tom Keetch <twkeetch () gmail com>
Date: Tue, 29 Mar 2011 15:54:18 +0100
Hi All, Adobe have yet to set a fix date for this cookie forcing issue I found in their Omniture product. If the affected "plug-in" is installed on a HTTPS protected site, then by setting a malicious cookie for the insecure domain, it is possible to hijack secure connections to the domain by injecting malicious JavaScript into the page via the cookie. This issue would be exploitable by a malicious WiFi access point. Chris Evans at Google explains this class of issue in far more detail here: http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html I am releasing this bug (in a personal capacity) because Adobe have been doing nothing with it for just short of three months and deem it to be not an issue. If this vulnerability affects your site, then disable the affected plug-in, or Omniture as a whole. If you wish to contact Apple (psirt () adobe com) about this bug, then please refer to PSIRT issue #798. I believe that it is more responsible to release this publically, than to leave it "undiscovered" in the product. Hardly a critical bug, but notable because it will apparently never be fixed (or I am wrong and no such issue exists). The affected code snippet is reproduced below. #### s_object_name.crossVisitParticipation = function(val, cookie_name, ex, ct, dl, events) { ... var cookie_value = this.cookie_read(cookie_name); ... var h = new Array; if (cookie_value && cookie_value != "") { arry = eval(cookie_value); } ... #### Cheers, Tom _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Adobe Omniture: Cookie-Forcing Issue Tom Keetch (Mar 29)
- Re: Adobe Omniture: Cookie-Forcing Issue Stefano Di Paola (Mar 29)