full-disclosure - Global *.net XSS, thank you Verisign(TM)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.NEB.4.53.0309160715380.5480@rhombus.znep.com>
From: marcs at znep.com (Marc Slemko)
Subject: Global *.net XSS, thank you Verisign(TM)

On Mon, 15 Sep 2003 xss_slut@...hmail.com wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Quite recently, Verisign took over the internet. What parts, you might
>
> ask?
>
> Well, the parts in nomad land.
>
> Do a dig on _anything_you_like.net, and you'll find an IP. Point a
> browser at http://junkurlblahblah.net, and you'll find yourself at
> sitefinder.verisign.com
>
> This by it's self doesn't create a vulnerability, however, when combined
>
> with a XSS bug, this works in IE:
>
> http://";alert('slut');".net

And how is this a security issue that is of anything more than trivial
importance?  How is it a "global XSS" hole?

The hole is on a page on sitefinder.verisign.com, not on the server that
is answering for *.net and *.com.  All that server does is redirect you.
The impact of the hole is the same regardless of if the *.com and *.net
wildcard exists or not.