hake Posted July 8, 2014 ID:850442 Share Posted July 8, 2014 Can MBAE prevent Abusing JSONP with Rosetta Flash? Adobe has released Flash Player 14.0.0.145 which is said to help mitigate a security threat, highlighted by Michele Spagnuolo, a security engineer at Google. http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ Link to post Share on other sites More sharing options...
Staff pbust Posted July 8, 2014 Staff ID:850444 Share Posted July 8, 2014 Yes, Flash Player is protected automatically by MBAE Free & Premium. Link to post Share on other sites More sharing options...
hake Posted July 9, 2014 Author ID:850546 Share Posted July 9, 2014 Thank you Pedro. MBAE is obviously therefore the antidote for unpunctual Adobe Flash updates. Link to post Share on other sites More sharing options...
FleischmannTV Posted July 10, 2014 ID:851042 Share Posted July 10, 2014 Pedro, I was wondering if this is an exploit which runs perfectly fine in a sandboxed environment because it doesn't require an infection of the system and hence sandboxing doesn't provide any protection against it? Link to post Share on other sites More sharing options...
Staff pbust Posted July 10, 2014 Staff ID:851104 Share Posted July 10, 2014 Yes, as this is not really the type of exploit that MBAE, EMET, Sandboxie would deal with, it is outside the scope of all. It basically allows a malicious third party to bypass the JSONP filter to load scripts between domains to be able to steal private information such as cookies, something that's not allowed by same-origin policy. It's something that websites need to fix on their end. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now