full-disclosure - Re: [WEB SECURITY] Unicode Left/Right Pointing Double Angel Quotation Mark bypass?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1962868651.20090605104235@Zoller.lu>
Date: Fri, 5 Jun 2009 10:42:35 +0200
From: Thierry Zoller <Thierry@...ler.lu>
To: "Arian J. Evans" <arian.evans@...chronic.com>
Cc: Prasad Shenoy <prasad.shenoy@...il.com>,
	Full-Disclosure <full-disclosure@...ts.grok.org.uk>,
	3APA3A <3APA3A@...urity.nnov.ru>,
	"websecurity@...appsec.org" <websecurity@...appsec.org>
Subject: Re: [WEB SECURITY] Unicode Left/Right Pointing
	Double Angel Quotation Mark bypass?

Hi,

AJE> We have seen 44 sites in the last year at WhiteHat Security that were
AJE> vulnerable to Fullwidth unicode-encoded attacks. This one tends to be
AJE> more ubiquitous than others when you find it. In the applications weak
AJE> to this -- we found roughly 200 locations vulnerable to attack in
AJE> those 44 applications, and each location would have multiple inputs,
AJE> so you are probably talking 1,000+ inputs vulnerable to attack using
AJE> this encoding.

The   discussion   of   how  many  inputs  are  vulnerable  is kind of
ludicrous isn't it? As it nearly always boils down to the same set of impacts
even if you have a trillion of inputs vulnerable, per domain.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/