bugtraq - Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ADEBD71E92984607B8058F44523CD231@control3>
Date: Sat, 6 Oct 2007 12:43:16 -0400
From: "Geo." <geoincidents@....net>
To: <bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk>
Subject: Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape,Miranda, Skype

----- Original Message ----- 
From: "Thierry Zoller" <Thierry@...ler.lu>

> What you call for is in essence - mitigation, yes it's fine to mitigate
> a "vulnerability". But shouldn't we be concentrating on finding and
> fixing the root cause instead of trying to mitigate the problem in
> (hundrets) of third-party applications ?

If the application is what exposes the URI handling routine to untrusted 
code from the internet, then it's the application's job to make sure that 
code is trusted before exposing system components to it's commands, no?

In this case how is acrobat reader any different than telnetd? If telnetd 
exposes system functions to untrusted users (no password required) who is 
supposed to enforce security? In the case of acrobat reader, it's acrobat 
exposing the system to untrusted sources and it should be that application 
that is responsible for mitigation of attacks via those exposed interfaces.

Geo.