Re:Avast Antivirus: X.509 Error Rendering Command Execution
by userbinator on Saturday October 10, 2015 @05:08PM
(#10367016)
this ins't excusable under gosh software is complicated,
You're right - this happened precisely because they've made the software more complex than it needs to be. There's literally nothing in a certificate which requires HTML rendering capabilities. Using a plaintext field, the way it would've been done before the "web everything" trend, would not have resulted in this vulnerability.
I have a MITM proxy for filtering too, and testing it with the PoC cert just causes the CN to be displayed as plaintext in the warning message. It does not attempt to interpret it in any other way, as it should be.
You're right - this happened precisely because they've made the software more complex than it needs to be. There's literally nothing in a certificate which requires HTML rendering capabilities. Using a plaintext field, the way it would've been done before the "web everything" trend, would not have resulted in this vulnerability.
I have a MITM proxy for filtering too, and testing it with the PoC cert just causes the CN to be displayed as plaintext in the warning message. It does not attempt to interpret it in any other way, as it should be.