Re:Avast Antivirus: X.509 Error Rendering Command Execution
by userbinator on Saturday October 10, 2015 @05:08PM
(#10367016)
this ins't excusable under gosh software is complicated,
You're right - this happened precisely because they've made the software more complex than it needs to be. There's literally nothing in a certificate which requires HTML rendering capabilities. Using a plaintext field, the way it would've been done before the "web everything" trend, would not have resulted in this vulnerability.
I have a MITM proxy for filtering too, and testing it with the PoC cert just causes the CN to be displayed as plaintext in the warning message. It does not attempt to interpret it in any other way, as it should be.
Re:Avast Antivirus: X.509 Error Rendering Command Execution
by jimrandomh on Saturday October 10, 2015 @02:32PM
(#10366430)
This seems unnecessarily harsh. As you said, XSS is one of the most common vulnerabilities out there - in other words it's a very easy and common mistake to make. I wish we lived in a world where writing an XSS vulnerability was inexcusable incompetence, but the actual world we live in is one where even the best will slip up sometimes and we have to depend on audits, patching and defense in depth. (Which is exactly what happened here; a security researcher audited it, found the problem, and it was promptly patched.)
So while this is very stupid, this ins't excusable under gosh software is complicated, this is basically XSS in a desktop application.
If this was some RCE through the scanning or sand-boxing engine I would say fine, but this is pretty much the most common web vulnerability out there, I don't understand companies that build HTML based interfaces and decide to simply forgo all of the existing guidelines for web development because it's not a website.