full-disclosure - Re: [FD] The Misfortune Cookie Vulnerability

Open Source and information security mailing list archives

Message-ID: <CAJCB1PH6G1VL4gcTBtgYSbzbiXGzYZ03dVO-_-zmq1RwgODEpw@mail.gmail.com>
Date: Tue, 23 Dec 2014 08:58:03 -0800
From: Jon Hart <jhart@...ofed.org>
To: Shahar Tal <shahartal@...ckpoint.com>
Cc: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] The Misfortune Cookie Vulnerability

At least on the pile of RomPager 4.01 devices that I have access to,
they use straight HTTP authentication by default and do not use any
cookies from what I can see.  That's not to say that there isn't
cookie handling code exposed in some way.  It is also possible that
these devices have already been patched against this vulnerability and
the version was unchanged, or that they are so highly customized that
the vulnerability is irrelevant.

-jon

On Thu, Dec 18, 2014 at 11:11 PM, Shahar Tal <shahartal@...ckpoint.com> wrote:
> Well noted.
> I do trust members of this list to help release the information I couldn't.
>
> Cheers,
> Shahar
>
> ________________________________
> From: Michal Zalewski
> Sent: Friday, December 19, 2014 6:56:20 AM
> To: Shahar Tal
> Cc: fulldisclosure@...lists.org
> Subject: Re: [FD] The Misfortune Cookie Vulnerability
>
>> See http://mis.fortunecook.ie for the rest.
>
> I think you might have accidentally pasted the wrong link. This one
> doesn't seem to contain additional information.
>
> Cheers,
> /mz
>
> Email secured by Check Point.
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives