Re: [hybi] Handshake was: The WebSocket protocol issues.

[Eric Rescorla <[e-mail]>]

On Mon, Oct 11, 2010 at 5:05 PM, Scott Ferguson <[e-mail]> wrote:

> Adam Barth wrote:
>
>> On Mon, Oct 11, 2010 at 9:56 AM, Scott Ferguson <[e-mail]> wrote:
>>
>>
>>> You didn't address point #6, the open DELETE.
>>>
>>> The target is pre-compromised because it has an open DELETE (point #6)
>>> and
>>> the target is pre-compromised because it's on the same machine as the
>>> attacker (point #1).
>>>
>>> You're requiring a pre-compromised target to make this attack work.
>>>
>>>
>>
>> I'm not sure what pre-compromised means.  I'm not sure that I'd run my
>> servers in this configuration, but that doesn't mean lots of other
>> people don't.
>>
>>
>
> 1. Your target has an open vulnerability ("DELETE") to non-browser clients
> 2. Your attacker is running an arbitrary program on the same machine as the
> target.
>

I'm not going to argue about the rest of these, but as I've said before,
this is absolutely
a standard case. It's how shared hosting works, and I (and near  everyone
else) expects the
relevant machines to be configured in a way that it's not simple for
customers to attack
each other directly via this mechanism. cf. jails, etc.

-Ekr