|
Mozilla considers disabling Java in Firefox |
|
|
|
Source: H Security - Posted by Dave Wreski
|
The Firefox developers are currently discussing whether to disable Oracle's Java plug-in as a potential workaround for the recently disclosed SSL/TLS vulnerability. The Java plug-in is the component that enables attackers to exploit the vulnerabilities presented by Juliano Rizzo and Thai Duong last week – the two researchers demonstrated how the cookies of arbitrary web pages can be reconstructed despite being sent via encrypted connections.
For their chosen-plaintext attack on the Cipher-Block Chaining (CBC) mode that tends to be used with TLS, Rizzo and Duong have to bypass the browser's Same Origin Policy (SOP) so that they can communicate with servers outside of, for instance, the Java applet's domain.
Read this full article at H Security
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
