bugtraq - Re[4]: [Full-disclosure] Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari, Opera, Chrome, Seamonkey, iPhone, iPod, Wii, PS3....

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.51.0907211656180.18458@faron.mitre.org>
Date: Tue, 21 Jul 2009 17:10:46 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Thierry Zoller <Thierry@...ler.lu>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
	Michal Zalewski <lcamtuf@...edump.cx>,
	bugtraq <bugtraq@...urityfocus.com>,
	full-disclosure <full-disclosure@...ts.grok.org.uk>,
	info@...cl.etat.lu, vuln@...unia.com, cert@...t.org, nvd@...t.gov,
	cve@...re.org
Subject: Re[4]: [Full-disclosure] Update: [GSEC-TZO-44-2009] One bug to rule
 them all - Firefox, IE, Safari, Opera, Chrome, Seamonkey, iPhone, iPod, 
 Wii, PS3....

On Tue, 21 Jul 2009, Thierry Zoller wrote:

> Yeah, security is too complex.  Dude, the fix was to LIMIT the the
> number of elements. This is not rocket science.

I believe Michal and I are having the conversation in a larger context.
What you found is valid on its own merit and got addressed, which is
great.  But now think of the whole ECMAScript API and there are probably
dozens or hundreds of such functions that would expose similar issues.
There could be a lot of individual reports for each individual function,
or one concerted effort that looks at everything at once.  (I'm not saying
you should have done this - after all it's your research - I'm just saying
that *somebody* could.)  Extend this to things like web-connected
interpreters (PHP anyone?) and similar logic may well apply.

I'm sure that I've generated web pages with about 10,000 elements, so now
it sounds like this simple "select" fix could break that.  (Maybe I didn't
have any business doing such gruesome things, but it wasn't technically
incorrect to do so.)

- Steve