bugtraq - Re: [Full-disclosure] Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <71DFF388-F8AC-494A-B547-01C3AB9B51B8@doxpara.com>
Date: Wed, 20 Oct 2010 10:38:12 -0700
From: Dan Kaminsky <dan@...para.com>
To: Michal Zalewski <lcamtuf@...edump.cx>
Cc: Roberto Suggi Liverani <roberto.suggi@...urity-assessment.com>,
	full-disclosure <full-disclosure@...ts.grok.org.uk>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: [Full-disclosure] Security-Assessment.com Advisory: Oracle JRE - java.net.URLConnection class - Same-of-Origin (SOP) Policy Bypass



Sent from my iPhone

On Oct 20, 2010, at 8:58 AM, Michal Zalewski <lcamtuf@...edump.cx> wrote:

>> Security-Assessment.com follows responsible disclosure
>> and promptly contacted Oracle after discovering
>> the issue. Oracle was contacted on August 1,
>> 2010.
> 
> My understanding is that Stefano Di Paola of Minded Security reported
> this back in April; and further, the feature was a part of reasonably
> well-documented functionality of Java pretty much ever since:
> 
> http://download.oracle.com/javase/6/docs/api/java/net/URL.html
> 
> "Two hosts are considered equivalent if both host names can be
> resolved into the same IP addresses"
> 
> This was a pretty horrible design, so it's good to see it gone, though.

Eh, you can see where it came from though. Design bugs like this are absolutely miserable to fix (see how we'll never get rebinding out of the browser) and letting identical IP's script against eachother lets an awful lot of legitimate traffic through while blocking almost all attacks.

I'm not saying it's a preferred design, but let's reserve "horrible" for things that don't have quite the obvious thought process behind them.

Is this, in fact, gone now?

> 
> /mz
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/