Re:The ups and downs of the HTTP header
by ChickeNES on Friday December 06, 2013 @01:53PM
(#6862827)
This tripped me up to no end when I had to implement a web proxy in one of my intro to CS classes. I couldn't find this mentioned in the standard anywhere and different browsers treated it differently.
[ Parent
| on HN ]
Re:The ups and downs of the HTTP header
by MichaelGG on Friday December 06, 2013 @04:05PM
(#6863798)
I've discovered exploitable holes "in-the-wild" due to SIP using the same inane parsing rules. Proxy A asserts security and billing. Server B processes the message but instead of reading Proxy A's assertions, it reads "cutely formed" data directly from the client.
Fixing is a royal pain, because some systems require the behaviour to be one way or another.
"Fortunately" security in VoIP is such a joke that tricks like this aren't the biggest issue and so far, I've not seen any such attempts in any attacks.