full-disclosure - phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6170a5450510251414v5e1c9876o3fa033b56d65efbb@mail.gmail.com>
Date: Tue Oct 25 22:14:56 2005
From: tatercrispies at gmail.com (Tatercrispies)
Subject: phpBB 2.0.17 (and other BB systems as well)
	Cookie disclosure exploit.

On 10/25/05, Paul Laudanski <zx@...tlecops.com> wrote:
>
>
> Anyone have other ideas on this? I've already implemented some code to
> validate file input and its working. But is this the right approach?
>

Since it is an IE issue, you may as well be using HttpOnly cookies. It isn't
a perfect fix, but maybe "good enough" for the meantime.

I think the fact that it's exploitable at even
hotmail.com<http://hotmail.com>will prompt MS to do something quickly.
I don't think it's reasonable to
expect every two-bit web script to need to validate the integrity of image
uploads. What about folk without the graphics libraries to accomplish this.
Are there pure PHP/ASP scripts capable of doing this-- and can we place our
trust in them?

The HTTP protocol is saying "Treat this as an image" and then IE goes ahead
and "Uhh, you know what, I think I'm going to do my own thing here and
execute some script". I'm kind of surprised this technique has been
available all along and not reported until just now. Maybe I'm just
overreacting.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051025/6201d507/attachment.html