[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    Re: [FD] The Misfortune Cookie Vulnerability
From:       Jon Hart <jhart () spoofed ! org>
Date:       2014-12-23 16:58:03
Message-ID: CAJCB1PH6G1VL4gcTBtgYSbzbiXGzYZ03dVO-_-zmq1RwgODEpw () mail ! gmail ! com
[Download RAW message or body]

At least on the pile of RomPager 4.01 devices that I have access to,
they use straight HTTP authentication by default and do not use any
cookies from what I can see.  That's not to say that there isn't
cookie handling code exposed in some way.  It is also possible that
these devices have already been patched against this vulnerability and
the version was unchanged, or that they are so highly customized that
the vulnerability is irrelevant.

-jon

On Thu, Dec 18, 2014 at 11:11 PM, Shahar Tal <shahartal@checkpoint.com> wrote:
> Well noted.
> I do trust members of this list to help release the information I couldn't.
>
> Cheers,
> Shahar
>
> ________________________________
> From: Michal Zalewski
> Sent: Friday, December 19, 2014 6:56:20 AM
> To: Shahar Tal
> Cc: fulldisclosure@seclists.org
> Subject: Re: [FD] The Misfortune Cookie Vulnerability
>
>> See http://mis.fortunecook.ie for the rest.
>
> I think you might have accidentally pasted the wrong link. This one
> doesn't seem to contain additional information.
>
> Cheers,
> /mz
>
> Email secured by Check Point.
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]