full-disclosure - Re: Internet Explorer and Opera local zone restriction bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200310302141.h9ULfEX386414@milan.maths.usyd.edu.au>
From: psz at maths.usyd.edu.au (Paul Szabo)
Subject: Re: Internet Explorer and Opera local zone restriction bypass

William A. Schulze <was@...romedia.com> wrote in
http://www.securityfocus.com/archive/1/342910 :

> ... Flash Player stores cookies in a somewhat predictable location
> (assuming the username can be guessed), and some of the contents are
> stored as plain text. While this is not in itself a directly exploitable
> vulnerability, an exploit can be created in combination with a security
> flaw in the browser. Macromedia will therefore make changes so that
> browser vulnerabilities of this nature cannot be exploited using the
> Flash Player.

I applaud Macromedia's commitment to security, being willing even to work
around a security problem in InternetExplorer.

Thor Larholm <thor@...x.com> had written in
http://www.securityfocus.com/archive/1/342467 :

> ... Flash allows you to store arbitrary content in a known location ...
> in plaintext ... can easily be fixed by applying ... slight obfuscation
> of the contents ...

Storing in an unpredictable location might help. Obfuscation does not:
instead of setting a cookie of BadThing, the attacker could set one that
will become BadThing. The need to reverse-engineer the obfuscation, and
details like possible character sets, are a minor hindrance only. Security
by obscurity does not work.

The problem of predictable location and content is NOT in Flash but in IE.
It is arrogant of MS apologists to suggest, and of MS to expect, that other
software should work around their security issues. Will user habits of
downloading to MyDocuments (or the desktop or C:\) be patched also?

Avenues of exploitation, not using Flash, will be found. Fix IE, or else.

Cheers,

Paul Szabo - psz@...hs.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia