This is relatively easy to exploit. It takes some degree of social engineering -- the attacker would have to draw people to a malicious Web site -- but after that, there's no further intervention required. An attacker could leverage this to write to a file on the hard drive. And once you can write to a person's machine, you have full control.
More Quotes from Michael Sutton:
Many of our most valuable contributors consistently identify significant vulnerabilities that may never make the front page, but both avert major exploitation and secure considerable compensation through our rewards program.Michael Sutton
The only model that makes no sense to me is the altruistic model. The vendor wants the researcher to do his code review for free and that doesn't quite fly. They are profiting from the vulnerability information but they don't want to pay for it.
Michael Sutton
The vulnerability still exists in Internet Explorer in that it's very lenient in how it pulls CSS, but right now nobody is publishing a way that it can be leveraged to do something useful. That's not to say that somebody won't find a way. I'm sure somebody will come up with a creative way to leverage it to do something evil.
Michael Sutton
The nice thing is that a third party that has nothing to do with the VCP is deciding what the criticality is. We're still signing the contract with the researcher and we're still paying the fee for the specific contributor, but we're saying that if it results in a critical bulletin, there's a 10,000 bonus on the table.
Michael Sutton
There is some irony there.
Michael Sutton
Readers Who Like This Quotation Also Like:
Based on Keywords: attackerFor lack of a better term, they've labeled me a sex symbol. It's flattering and it should happen to every bald, overweight guy.
Dennis Franz
I'm really into Sweet 75 right now, and I dig playing Nirvana, don't get me wrong. Even if Kurt never died, more than likely I'd be in Sweet 75 today still.
Krist Novoselic
The sound principle of a topsy-turvy lifestyle in the framework of an upside-down world order has stood every test.
Karl Kraus