Re: Apple Safari: idn urlbar spoofing
- From: Robert Swiecki <jagger@xxxxxxxxxxx>
- Date: Wed, 27 Jun 2007 11:27:40 +0200
Michal Zalewski wrote:
Whether Safari devs are to blame here exclusively, I'm not sure - IDN
concept is by itself pretty evil, and this can be viewed simply a clever
take on homograph attacks.
I found out that firefox has a configuration property:
network.IDN.blacklist_chars. It includes the character used in the
demonstration (ㅤ - HANGULL FILLER) and many more. So, the problem
seems to be known (at least in firefox).
--
Robert Swiecki
http://www.swiecki.net
- References:
- Apple Safari: cookie stealing
- From: Robert Swiecki
- Re: [Full-disclosure] Apple Safari: urlbar/window title spoofing
- From: Robert Swiecki
- Re: Apple Safari: idn urlbar spoofing
- From: Robert Swiecki
- RE: [Full-disclosure] Apple Safari: idn urlbar spoofing
- From: Larry Seltzer
- Re: [Full-disclosure] Apple Safari: idn urlbar spoofing
- From: Michal Zalewski
- Apple Safari: cookie stealing
- Prev by Date: [ MDKSA-2007:136 ] - Updated evolution packages fix vulnerability
- Next by Date: Conti FTP Server v1.0 DoS
- Previous by thread: Re: [Full-disclosure] Apple Safari: idn urlbar spoofing
- Next by thread: iDefense Security Advisory 06.13.07: Multiple Vendor libexif Integer Overflow Heap Corruption Vulnerability
- Index(es):
Relevant Pages
|
