[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
- To: <bugtraq@xxxxxxxxxxxxxxxxx>, <full-disclosure@xxxxxxxxxxxxxxxxx>
- Subject: Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
- From: "Geo." <geoincidents@xxxxxxx>
- Date: Sat, 6 Oct 2007 12:43:16 -0400
----- Original Message -----
From: "Thierry Zoller" <Thierry@xxxxxxxxx>
> What you call for is in essence - mitigation, yes it's fine to mitigate
> a "vulnerability". But shouldn't we be concentrating on finding and
> fixing the root cause instead of trying to mitigate the problem in
> (hundrets) of third-party applications ?
If the application is what exposes the URI handling routine to untrusted
code from the internet, then it's the application's job to make sure that
code is trusted before exposing system components to it's commands, no?
In this case how is acrobat reader any different than telnetd? If telnetd
exposes system functions to untrusted users (no password required) who is
supposed to enforce security? In the case of acrobat reader, it's acrobat
exposing the system to untrusted sources and it should be that application
that is responsible for mitigation of attacks via those exposed interfaces.
Geo.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/