full-disclosure - Re: Fwd: Google vulnerabilities with PoC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJB2JzutwW=G2Dq5pBZGDrVu3VsvALuRfcyoL7=ZNaBazC_rpA@mail.gmail.com>
Date: Mon, 17 Mar 2014 16:25:05 +0100
From: Mario Vilas <mvilas@...il.com>
To: Ulisses Montenegro <ulisses.montenegro@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
 Joxean Koret <joxeankoret@...oo.es>
Subject: Re: Fwd: Google vulnerabilities with PoC

On Mon, Mar 17, 2014 at 3:11 PM, Ulisses Montenegro <
ulisses.montenegro@...il.com> wrote:

> Should YouTube restrict file uploads to known valid mime types? Sure, but
> that's only how you got the data in there to begin with. It's what happens
> after the data is in that will make all the difference.

At this point I'm not even sure the data isn't being restricted - it just
may be that the data type is checked again after it gets pulled out of the
queue for processing, and if it's not a video it gets discarded.

-- 
“There's a reason we separate military and the police: one fights the enemy
of the state, the other serves and protects the people. When the military
becomes both, then the enemies of the state tend to become the people.”

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/