Re: [Full-disclosure] Google Chrome pkcs11.txt File Planting

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

For what it's worth, I found this article to be far more "matter of fact" in 
regard to the general concept, the existing (default) conditions in play, and 
the conditions which need to be in place (or manipulated) in order for this to 
be exploited than some of the other material your company has presented in the 
past.    Noting "it may or may not be a vulnerability" shows some research 
maturity and business intelligence on your part, and was actually refreshing. 

When researchers spend too much time painting dire pictures of impact based on 
(what is typically) non-standard or exaggerated exposure scenarios, the actual 
message in the research is lost.  In this case, developers can very easily see 
how including features that support functions such as 
"library=\\www.binaryplanting.com\demo\chrome_pkcs11Planting\malicious.lib" is 
a really bad idea.

t


>-----Original Message-----
>From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-
>bounces@xxxxxxxxxxxxxxxxx] On Behalf Of ACROS Security Lists
>Sent: Friday, October 21, 2011 2:07 AM
>To: bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx;
>cert@xxxxxxxx; si-cert@xxxxxxxx
>Subject: [Full-disclosure] Google Chrome pkcs11.txt File Planting
>
>
>A month ago our company notified Google about a peculiar behavior of
>Chrome browser that can be exploited for execution of remote code outside
>Chrome sandbox under specific conditions. Our new blog post describes it all.
>
>http://blog.acrossecurity.com/2011/10/google-chrome-pkcs11txt-file-
>planting.html
>
>or
>
>http://bit.ly/olK1P9
>
>Enjoy the reading!
>
>
>Mitja Kolsek
>CEO&CTO
>
>ACROS, d.o.o.
>Makedonska ulica 113
>SI - 2000 Maribor, Slovenia
>tel: +386 2 3000 280
>fax: +386 2 3000 282
>web: http://www.acrossecurity.com
>blg: http://blog.acrossecurity.com
>
>ACROS Security: Finding Your Digital Vulnerabilities Before Others Do
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/