scoutt

(November 4 & 5, 2009)
A problem with the way browsers handle cookies could be exploited to
attack a website's main domain through its subdomains. A researcher
has published a paper in which he offers proof-of-concept examples of
the attack for the Google, Expedia and Chase Manhattan Bank websites.
The problem lies in a browser protocol, RFC 2965, which says "that
browsers must allow subdomains to set and read cookies for their
parent."
http://www.darkreading.com/security/...es+and+threats
http://www.securecomputing.net.au/Ne...ack-space.aspx
http://www.theregister.co.uk/2009/11...okie_stealing/

__________________
Have a Script or Snippet you want to share?

WWW Standards: HTML 4.01, CSS2.1, CSS3, XHTML 1.0
PHP Standards: PHP Standards