OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: [Full-disclosure] Apple Safari: cookie stealing

From: Michal Zalewski (lcamtufdione.ids.pl)
Date: Wed Jun 13 2007 - 09:46:59 CDT


On Wed, 13 Jun 2007, Robert Swiecki wrote:

> The flaw exists in the javascript's window.setTimeout() implementation.

Forgive me the rant, but... all other recently reported problems aside,
seeing this, I can only ask - which rock did Safari developers hide under
for the past 8 years or so?

I mean... this is the type of a flaw you probably no longer even to test
for because it seems too obvious - 'ping -l 65510' of the browser world...

/mz