full-disclosure - Re: noise about full-width encoding bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <242a0a8f0705210833n12593912y1cf44ce09e0e07@mail.gmail.com>
Date: Mon, 21 May 2007 11:33:08 -0400
From: "Brian Eaton" <eaton.lists@...il.com>
To: "Łukasz Pilorz" <lukasz@...orz.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: noise about full-width encoding bypass?

On 5/21/07, Łukasz Pilorz <lukasz@...orz.net> wrote:
> I think this encoding bypass may have some impact on applications
> which convert data from Unicode/UTF to other encodings. A naive
> example:
> http://lukasz.pilorz.net/testy/full_width_utf/index.phps
>
> But I don't suggest this was the main problem, I have probably missed
> something too.

Your POC works for me, the PHP iconv code converts the UTF-8 byte
sequence 0xef  0xbc 0x9C to ASCII '<'.  Looks like PHP applications
may be at risk.

The java CharsetDecoder class does not.  (I don't think this will be
JRE specific, but I tested the IBM JRE...).

The perl Encode module does not.

Anybody have an IIS server handy, to test out how .NET handles this?

Regards,
Brian
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/