full-disclosure - RSS Injection in Sage part 2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f4cd4c010611081618i6fb56eb3r92edfbd495a346fe@mail.gmail.com>
Date: Thu, 9 Nov 2006 00:18:57 +0000
From: "David Kierznowski" <david.kierznowski@...il.com>
To: full-disclosure@...ts.grok.org.uk, security-basics@...urityfocus.com, 
	"Webappsec Mail List" <webappsec@...urityfocus.com>
Cc: petea@....edu
Subject: RSS Injection in Sage part 2

RSS Injection is Sage part 2

2 months ago, both pdp and myself released a vulnerability and proof
of concept exploit for Sage. (see:
http://michaeldaw.org/md-hacks/cross-context-scripting-with-sage/).
This issue was resolved in Sage release 1.3.7 (
http://mozdev.org/bugs/show_bug.cgi?id=15101). I  found a new
vulnerability which affects the latest version, Sage 1.3.8. In
addition to the XSS vulnerability, it should be noted (as with the
previous vulnerability) this issue occurs within the Local Browser
Context. This means arbitrary file access etc.

Full details and POC can be found at:
http://michaeldaw.org/md-hacks/rss-injection-in-sage-part-2/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/