lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue Oct 25 22:21:37 2005
From: zx at castlecops.com (Paul Laudanski)
Subject: Re: phpBB 2.0.17 (and other BB systems as well)
 Cookie disclosure exploit.

On Tue, 25 Oct 2005, Tatercrispies wrote:

> On 10/25/05, Paul Laudanski <zx@...tlecops.com> wrote:
> >
> >
> > Anyone have other ideas on this? I've already implemented some code to
> > validate file input and its working. But is this the right approach?
> >
> 
> Since it is an IE issue, you may as well be using HttpOnly cookies. It isn't
> a perfect fix, but maybe "good enough" for the meantime.
> 

See this thread in terms of what has been found to be exploitable 
(browsers): 

http://castlecops.com/p645421-Strange.html

> I think the fact that it's exploitable at even
> hotmail.com<http://hotmail.com>will prompt MS to do something quickly.
> I don't think it's reasonable to
> expect every two-bit web script to need to validate the integrity of image
> uploads. What about folk without the graphics libraries to accomplish this.
> Are there pure PHP/ASP scripts capable of doing this-- and can we place our
> trust in them?

If sites want to stay online that make use of dynamic content to some 
extent the onus is on them to do proper input validation.  There are PHP 
functions which permit for checking.  But again, they work well when 
checking local images.

-- 
Paul Laudanski, Microsoft MVP Windows-Security
http://castlecops.com - http://wiki.castlecops.com

CastleCops Deutsch - German Internet Security coming soon!

Powered by blists - more mailing lists