Not logged in | Login

My Security Planet » Security Thoughts » October 21, 2010

Feeds

13617 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

SEO

Tools

Tools

Opensourcetesting.org News

Security Thoughts

Java DSN Rebinding + Java Same IP Policy = The Internet Mayhem

Posted: October 21st, 2010, 5:40am CDT

Tags: [edit]

This is a short blog post about what could have happened if a malicious user had exploited the issues I found.

If someone has read the post about Java DNS Rebinding and Java applet same IP Host Access probably has come
to the same conclusion of what I am going to describe in the next few lines which can be summarized like this:
Java applet implementation could really break the web.

Consider the following points:

* Java DNS Rebinding: an attacker can point a controlled host to any IP of the web.
* Java applet same IP Host access: an attacker can read the response of any host which points to the same IP
the applet originates.

..Continue reading here
Java Applet Same IP Host Access

Posted: October 21st, 2010, 5:38am CDT

Tags: [edit]

Summary
Due to a design issue on the way Java considers Same Origin Policy, it is possible for an attacker controlling a host with the same IP of the victim host, to forge requests to victim host on behalf of a user and read the content of the response.

..Continue reading here

← October 20 (1 item) March 28 (1 item) →