full-disclosure - Re: www.google.com xss vulnerability Using mhtml

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 26 Jan 2011 18:46:39 -0800
From: IEhrepus <5up3rh3i@...il.com>
To: Michal Zalewski <lcamtuf@...edump.cx>
Cc: full-disclosure@...ts.grok.org.uk, Yigit Turgut <y.turgut@...il.com>
Subject: Re: www.google.com xss vulnerability Using mhtml

Obviously this problem is not clear. A very similar problem ,like the
"HTTP Response Splitting" ,Whose vulnerability? webapp or Server-side
language?

so we come back this vul need two Conditions

1.www.google.com app don't filter the CRLF

2.IE support mhtml protocol handler to render the mhtml file format,
and this is the why mhtml: is designed


so the football game is going ....

----by superhei

hitest



2011/1/26 Michal Zalewski <lcamtuf@...edump.cx>:
>> I woudn't like to discourage ppl submitting vulns to vendors but this is the
>> response you'll most likely to get from those kind of vendors no matter what
>> you found in their system. I had more than a dozen similar experience like
>> yours. Now it's public + fixed and you gotta get nothing beside these
>> replies (:
>
> I think you'd be surprised. Our reward panel consists solely of people
> you would recognize from this list, BUGTRAQ, or vendor advisories; and
> we are very consistent, timely, and pretty generous in rewarding a
> large proportion of all incoming reports. Ask around :-)
>
> In this particular case, though, the underlying problem is clearly a
> browser-side flaw that is nearly impossible to fully address on web
> application side - and one that first surfaced in 2004, then wasn't
> fully fixed in 2007:
>
> http://openmya.hacker.jp/hasegawa/security/ms07-034.txt
>
> Even in cases like this, we sometimes reward the reporter when we are
> given advance notice, and there are clear ways we can protect our
> users. But in this instance, the report is already public, we are
> already aware it, and we are trying to deploy basic workarounds in a
> number of exposed spots; and as noted, realistically, there is a
> limited recourse any web app provider will have.
>
> /mz
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/