Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: VUPEN Security Research - Adobe Flash Player RTMP Data Processing Object Confusion (CVE-2013-2555)
From: Jeffrey Walton <noloader () gmail com>
Date: Mon, 22 Apr 2013 02:39:52 -0400

On Sat, Apr 20, 2013 at 7:37 PM, Benji <me () b3nji com> wrote:
Because security engineers are different to a QA department you originally
suggested, and you seem to be very ideologist about the scenarios. As we've
seen, Oracle's Java product has security engineers and this has not
prevented flaws.
Oracle is probably not a good example since it leaves known flaws in
the code base.


The warnings for Java applets now come in two types: an applet that
has a valid certificate generates a warning dialog with the Java logo
in it and details of the applet's certificate, but an applet that is
signed with an invalid certificate, is unsigned or self-signed, will
generate a warning with a yellow shield and warning triangle which is
designed to recommend that the applet should not be run. There is a
problem though with the certificate checking; as The H reported in
March, criminals were using revoked certificates as part of their
attacks and the Java runtime was doing nothing to check the validity
of certificates. On the latest update of Java, this has not changed
either; online validation and revocation checks are still off by

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]