First published: Fri Sep 30 2011(Updated: )
Deepak Bhole discovered a flaw in the Same Origin Policy (SOP) implementation in the IcedTea project Web browser plugin. A malicious applet could use this flaw to bypass SOP protection and open connections to any sub-domain of the second-level domain of the applet's origin, as well as any sub-domain of the domain that is the suffix of the origin second-level domain. For example, IcedTea-Web plugin allowed applet from some.host.example.com to connect to other.host.example.com, www.example.com, and example.com, as well as www.ample.com or ample.com.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/IcedTea-Web | <1.0.6 | 1.0.6 |
redhat/IcedTea-Web | <1.1.4 | 1.1.4 |
Redhat Icedtea-web | =1.0.4 | |
Redhat Icedtea-web | =1.1.1 | |
Redhat Icedtea-web | =1.1.2 | |
Redhat Icedtea-web | =1.0.2 | |
Redhat Icedtea-web | =1.0.3 | |
Redhat Icedtea-web | =1.0.5 | |
Redhat Icedtea-web | =1.1 | |
Redhat Icedtea-web | =1.0.1 | |
Redhat Icedtea-web | =1.1.3 | |
Redhat Icedtea-web | =1.0 | |
Canonical Ubuntu Linux | =10.10 | |
Canonical Ubuntu Linux | =11.04 | |
Canonical Ubuntu Linux | =11.10 | |
Canonical Ubuntu Linux | =10.04 | |
openSUSE openSUSE | =12.1 |
http://dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released/
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.