[B! security] harumaki_netã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

harumaki_net id:harumaki_net

securityã«é–¢ã™ã‚‹harumaki_netã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

S3çµŒç”±ã§XSS!?ä¸å¯æ€è°ãªContent-Typeã®å€¤ã‚’åˆ©ç”¨ã™ã‚‹æ”»æ’ƒæ‰‹æ³•ã®æ–°è¦³ç‚¹ - Flatt Security Blog
ã¯ã˜ã‚ã« ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®é½‹è—¤ã“ã¨azaraã§ã™ã€‚ä»Šå›žã¯ã€ä¸å¯æ€è°ãªContent-Typeã®å€¤ã¨ã€ã‚¯ãƒ©ã‚¦ãƒ‰æ™‚ä»£ã§ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒªã‚¹ã‚¯ã«ã¤ã„ã¦ãŠè©±ã—ã—ã¾ã™ã€‚ æœ¬ãƒ–ãƒã‚°ã¯ã€2024 å¹´ 3 æœˆ 30 æ—¥ã«é–‹å‚¬ã•ã‚ŒãŸ BSides Tokyo ã§ç™»å£‡ã—ãŸéš›ã®ç™ºè¡¨ã«ã¤ã„ã¦ã€ã¾ã¨ã‚ãŸã‚‚ã®ã§ã™ã€‚ ã¾ãŸã€ãƒ–ãƒã‚°è³‡æ–™åŒ–ã«ã‚ãŸã‚Šã€Content-Type ã®å‹•ä½œã‚„ä»•æ§˜ã«ãƒ•ã‚©ãƒ¼ã‚«ã‚¹ã—ãŸå½¢ã§å†ç·¨ã‚’è¡Œã„ã€ç™»å£‡æ™‚ã«å£é ã§è£œè¶³ã—ãŸå†…å®¹ã®è¿½è¨˜ã€å¿…è¦ã«å¿œã˜ãŸè£œè¶³ã‚’è¡Œãªã£ã¦ã„ã¾ã™ã€‚ ã¾ãŸã€æœ¬ãƒ–ãƒã‚°ã§è§£èª¬ã‚’ã™ã‚‹ BSides Tokyoã§ã®ç™ºè¡¨ã®ã‚‚ã†ä¸€ã¤ã®é¡Œã§ã‚ã‚‹ã€ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ã«ã¤ã„ã¦ã¯ã€ä»¥ä¸‹ã®ãƒ–ãƒã‚°ã‹ã‚‰ç¢ºèªã‚’ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã™ã®ã§ã€ã”è¦§ãã ã•ã„ã€‚ blog.flatt.tech ãªãœä»Šã€ã“ã®å•é¡Œã‚’å–ã‚Šä¸Šã’ã‚‹ã®ã‹ï¼Ÿ å¾“æ¥ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã«ãŠã„ã¦ã€Content-Type ã®å€¤ã‚’ä»»æ„ã®å€¤ã«è¨å®šã™ã‚‹ã“ã¨
harumaki_net 2024/05/30
ãƒ–ãƒ©ã‚¦ã‚¶

security
ãƒªãƒ³ã‚¯
ç§ãŒã©ã®ã‚ˆã†ã«ã—ã¦ã‚ãƒ¼ãƒã‚¬ãƒ¼ã‚’ã‚¯ãƒ©ãƒƒã‚¯ã—ã€æœ€çµ‚çš„ã«ç¬¬ä¸‰è€…ã®å—ä¿¡ãƒˆãƒ¬ã‚¤ã«è¡Œãã¤ã„ãŸã‹ | POSTD
(è¨³æ³¨ï¼š2016/9/28ã€é ‚ãã¾ã—ãŸãƒ•ã‚£ãƒ¼ãƒ‰ãƒãƒƒã‚¯ã‚’å…ƒã«è¨˜äº‹ã‚’ä¿®æ£ã„ãŸã—ã¾ã—ãŸã€‚) ã“ã¨ã®å§‹ã¾ã‚Šã¯ã€ã‚ã‚‹ã‚¹ãƒ‘ãƒ ã‚ãƒ£ãƒ³ãƒšãƒ¼ãƒ³ã§ã—ãŸã€‚ç”»åƒ1ã¯ã€ã‚¹ãƒ‘ãƒ å‘ã‘ã«ä»•æŽ›ã‘ãŸç½ ã«æœ€è¿‘å¼•ã£ã‹ã‹ã£ãŸã€ç–‘ã‚ã—ã„ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆãƒ•ã‚¡ã‚¤ãƒ«ãŒæ·»ä»˜ã•ã‚ŒãŸãƒ¡ãƒ¼ãƒ«ã§ã™ã€‚æ–‡é¢ã®è‹±èªžãŒã¨ã¦ã‚‚ç¨šæ‹™ãªã“ã¨ã«æ°—ä»˜ãã‹ã¨æ€ã„ã¾ã™ãŒã€ã“ã®ç¨šæ‹™ã•ãŒãƒ¡ãƒ¼ãƒ«å—ä¿¡è€…ã¸ã®è¦å‘Šã‚µã‚¤ãƒ³ã¨ãªã‚Šã¾ã™ã€‚ ç”»åƒ1ï¼šã‚¹ãƒ‘ãƒ ã‚µãƒ³ãƒ—ãƒ« æ·»ä»˜ã®ãƒ•ã‚¡ã‚¤ãƒ«ã¯ã€â€.docâ€ã®ãƒ•ã‚¡ã‚¤ãƒ«æ‹¡å¼µåã‚’ä½¿ã£ã¦ã„ã¾ã™ãŒã€å®Ÿéš›ã¯RTFï¼ˆãƒªãƒƒãƒãƒ†ã‚ã‚¹ãƒˆãƒ•ã‚¡ã‚¤ãƒ«ï¼‰ãƒ•ã‚¡ã‚¤ãƒ«å½¢å¼ã§ã€ç‰¹åˆ¥ã«ç´°å·¥ã•ã‚ŒãŸRTFãƒ•ã‚¡ã‚¤ãƒ«ã«ã‚ˆã‚‹ã‚¹ã‚¿ãƒƒã‚¯ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§ãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®è„†å¼±æ€§ã¯ã€CVE-2010-3333ã§æ–‡æ›¸åŒ–ã•ã‚Œã¦ãŠã‚Šã€â€pFragmentsâ€ã®å½¢ã‚’ã—ãŸãƒ—ãƒãƒ‘ãƒ†ã‚£ã‚’æ‰±ã†éš›ã«Microsoft Word RFTãƒ‘ãƒ¼ã‚µã‚’æ”»æ’ƒã™ã‚‹ã‚‚ã®ã§ã™ã€‚ã“ã‚Œã«å¯¾ã™ã‚‹ä¿®æ£ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ã¯5å¹´ä»¥ä¸Šå‰ã«ãƒ‘ãƒƒãƒã•ã‚Œã¦ã„ã¾ã™
harumaki_net 2016/08/10
security

æŠ€è¡“
ãƒªãƒ³ã‚¯
Dropboxã§ç´„694ä¸‡ä»¶ã®ãƒã‚°ã‚¤ãƒ³æƒ…å ±ãŒæµå‡ºã€æ‚ªç”¨ã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ã®ã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®å¤‰æ›´ã‚’
(07/22)Â ã‚»ãƒ¼ãƒ«ã§è³¼å…¥ã—ãŸFire HD 10ã‚¿ãƒ–ãƒ¬ãƒƒãƒˆï¼ˆ13ä¸–ä»£ï¼‰ãŒå±Šã„ãŸã®ã§ã‚»ãƒƒãƒˆã‚¢ãƒƒãƒ—ã™ã‚‹ (07/22)Â The Boysã‚·ãƒ¼ã‚ºãƒ³5ã¯2026å¹´ã«é…ä¿¡äºˆå®šã€ã“ã‚ŒãŒæœ€çµ‚ã‚·ãƒ¼ã‚ºãƒ³ã«ãªã‚Šã¾ã™ (07/20)Â iPhone SE 4ã¯iPhone 16ãƒ™ãƒ¼ã‚¹ã§9æœˆç™ºå£²ã‹ï¼Ÿæ–°ãŸãªå™‚ãŒå‡ºå›žã‚‹ (07/18)Â Apple Watchã‚’iPodã¨ã—ã¦ä½¿ãˆã‚‹ã‚°ãƒƒã‚ºãŒç™»å ´ã€ãƒ›ã‚¤ãƒ¼ãƒ«ã‚‚å‹•ä½œã™ã‚‹æœ¬æ ¼çš„ãªãƒ¤ãƒ„ (07/18)Â IOS 18ã®æ–°æ©Ÿèƒ½ï¼šã‚«ãƒ¬ãƒ³ãƒ€ãƒ¼ã®ãƒªãƒžã‚¤ãƒ³ãƒ€ãƒ¼ãŒä¾¿åˆ©ã€äºˆå®šã®é€šçŸ¥ã¯ã“ã‚Œã§ååˆ† (07/17)Â 2025å¹´å¾ŒåŠç™»å ´ã®M5ãƒãƒƒãƒ—æè¼‰MacBookã§ã‚«ãƒ¡ãƒ©ãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«åˆ·æ–°ã€çä½“ã®åˆ·æ–°ã«ã‚‚æœŸå¾… (07/16)Â iOS 18ã‚„macOS Sequoiaã®ãƒ‘ãƒ–ãƒªãƒƒã‚¯ãƒ™ãƒ¼ã‚¿ç‰ˆãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸ (07/16)Â Amazon Fireã‚¿ãƒ–ãƒ¬ãƒƒãƒˆãŒéŽåŽ»æœ€å®‰å€¤ã§è³¼å…¥ã®ãƒãƒ£ãƒ³ã‚¹ï¼ï¼ˆ7/17ã¾ã§ï¼‰ 2
harumaki_net 2014/10/15
dropbox

security
ãƒªãƒ³ã‚¯
RHEL5/CentOS5ã§GlobalSignã®ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ãŒæœ‰åŠ¹æœŸé™åˆ‡ã‚Œã§å¤§é¨’ãŽ
ã“ã‚“ã«ã¡ã¯ã€‚CTOã®é¦¬å ´ã§ã™ã€‚ æ˜¨æ™©1/28 21:00JSTã«RHEL5/CentOS5ã«ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã®ã†ã¡ã€GlobalSignã®æœ‰åŠ¹æœŸé™ãŒåˆ‡ã‚Œã¾ã—ãŸã€‚ ä¼´ã£ã¦REHL5/CentOS5ã‹ã‚‰ã®HTTPS(SSL)æŽ¥ç¶šã«ã¦GlobalSignã®è¨¼æ˜Žæ›¸ã‚’ä½¿ã£ã¦ã„ã‚‹ã‚µã‚¤ãƒˆã¸ã®æŽ¥ç¶šãŒã‚¨ãƒ©ãƒ¼ã«ãªã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ç§ã®ç¢ºèªã—ã¦ã„ã‚‹ç¯„å›²ã§ã¯ã€ curlã‚³ãƒžãƒ³ãƒ‰ã‚„PHPã®curlãƒ©ã‚¤ãƒ–ãƒ©ãƒªãªã©ã§ã®æŽ¥ç¶šæ™‚ã«æŽ¥ç¶šã‚¨ãƒ©ãƒ¼ã¨ãªã‚‹ã“ã¨ã«èµ·å› ã—ã¦ä»¥ä¸‹ã®ã‚ˆã†ãªå½±éŸ¿ãŒå‡ºã¦ã„ã¾ã™ã€‚ â€»æŽ¥ç¶šã•ã‚Œã‚‹å´ã§ã¯ãªãã¦ã€æŽ¥ç¶šã™ã‚‹å´ã§ã®å•é¡Œã§ã™â€» oauthãªã©ã®å¤–éƒ¨èªè¨¼ãŒä¸å¯ æ±ºæ¸ˆãªã©ã®å¤–éƒ¨é€£æºãŒä¸å¯ å¯¾ç– RHEL5ã®å ´åˆã€errataãŒå…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã®ã§updateã—ã¾ã—ã‚‡ã†ã€‚ Red Hat Customer Portal https://rhn.redhat.com/errata/RHEA-201
harumaki_net 2014/01/29
è¨¼æ˜Žæ›¸

security
ãƒªãƒ³ã‚¯
ã‚¦ã‚¤ãƒ«ã‚¹å¯¾ç–ã‚¢ãƒ—ãƒªã®æ¤œå‡ºåŠ›ãƒ»ä½¿ã„ã‚„ã™ã•ã«ã‚ˆã‚‹æ€§èƒ½æ¯”è¼ƒãƒ©ãƒ³ã‚ãƒ³ã‚°â€•â€•AV-TESTèª¿æŸ» #Android
ãƒ‰ã‚¤ãƒ„ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚½ãƒ•ãƒˆç¬¬ä¸‰è€…è©•ä¾¡æ©Ÿé–¢ã®AV-TESTãŒã€Androidå‘ã‘ã‚¦ã‚¤ãƒ«ã‚¹å¯¾ç–ã‚¢ãƒ—ãƒªã«ã¤ã„ã¦ãƒžãƒ«ã‚¦ã‚§ã‚¢æ¤œå‡ºåŠ›ã¨ãƒ¦ãƒ¼ã‚¶ãƒ“ãƒªãƒ†ã‚£ï¼ˆãƒãƒƒãƒ†ãƒªãƒ¼æ¶ˆè²»ã€é€šä¿¡é‡ã€å‹•ä½œç‰ï¼‰ã®å´é¢ã‹ã‚‰ã€ãã®æ€§èƒ½ã‚’ã‚¹ã‚³ã‚¢è©•ä¾¡ã—ãŸèª¿æŸ»çµæžœã‚’ç™ºè¡¨ã—ã¦ã„ã‚‹ã€‚åŒèª¿æŸ»ã®æ¦‚è¦ã¨ã€å¯¾è±¡ã¨ãªã£ãŸã‚¢ãƒ—ãƒªã‚’ã‚¹ã‚³ã‚¢ã«åŸºã¥ããƒ©ãƒ³ã‚ãƒ³ã‚°åŒ–ã—ã¦ç´¹ä»‹ã™ã‚‹ã€‚ ãƒžãƒ«ã‚¦ã‚§ã‚¢æ¤œå‡ºåŠ›ãƒ»ãƒ¦ãƒ¼ã‚¶ãƒ“ãƒªãƒ†ã‚£ã®ãƒ†ã‚¹ãƒˆæ¦‚è¦ ä»Šå›žã®èª¿æŸ»ã§å¯¾è±¡ã¨ãªã£ãŸè£½å“ã¯è¨ˆ22æœ¬ã€‚Kasperskyã€Symantecï¼ˆãƒŽãƒ¼ãƒˆãƒ³ï¼‰ã€Trend Microã€Dr.Webã€Lookoutã€F-Secureãªã©ã®ãƒ¡ã‚¸ãƒ£ãƒ¼ã©ã“ã‚ã‹ã‚‰ã€ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ãªã„ãƒ™ãƒ³ãƒ€ãƒ¼ã®ã‚‚ã®ã¾ã§å¹…åºƒãæ¯”è¼ƒã•ã‚Œã¦ã„ã‚‹ã€‚èª¿æŸ»ã¯2013å¹´1æœˆã«è¡Œã‚ã‚ŒãŸã€‚ ãƒžãƒ«ã‚¦ã‚§ã‚¢æ¤œå‡ºçŽ‡ã«ã¤ã„ã¦ã¯ã€4é€±é–“ä»¥å†…ã«å‡ºç¾ã—ãŸæœ€æ–°ã®ç´„850-1000å€‹ã«åŠã¶ãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚µãƒ³ãƒ—ãƒ«ã‚’ç”¨ã„ã¦è¡Œã£ãŸã€‚SDã‚«ãƒ¼ãƒ‰ä¸Šã«ã‚³ãƒ”ãƒ¼ã•ã‚ŒãŸã‚µãƒ³ãƒ—ãƒ«ã‚’ãƒ•ãƒ«ã‚¹ã‚ãƒ£ãƒ³ã§ã©
harumaki_net 2013/02/23
security

å‚è€ƒ
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ï¼†ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚ãƒ£ãƒ³ãƒ—ã®CTFã§å‡ºé¡Œã—ãŸXSSå•é¡Œ - è‘‰ã£ã±æ—¥è¨˜
é›£ã—ã™ãŽã¦è§£ã‘ãªã„ã‚ˆï¼ã¨ä¸æº€å™´å‡ºã ã£ãŸå•é¡Œã€‚æ¥å¹´ã‚„ã‚‹ã¨ã—ãŸã‚‰ã€ã”ã£ãã‚Šå¤‰æ›´ã™ã‚‹ã®ã§å…¬é–‹ã—ã¡ã‚ƒãŠã†ã€‚ http://utf-8.jp/cgi-bin/xss1/search.cgi http://utf-8.jp/cgi-bin/xss2/search.cgi http://utf-8.jp/cgi-bin/xss3/search.cgi (è¿½è¨˜) å›žç”ä¾‹ã‚’ã‚ãƒ£ãƒ³ãƒ—å—è¬›ç”Ÿã® @tyage ã•ã‚“ãŒæ›¸ã„ã¦ãã‚Œã¦ã„ã¾ã™ã€‚GJ! XSSãƒ¡ãƒ¢æ›¸ã | ãƒãƒ£ã‚²ã£ã¦ã‚‹æ—¥ã€…
harumaki_net 2012/02/17
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

XSS

security

ã‚ã¨ã§èªã‚€

é‡è¦
ãƒªãƒ³ã‚¯
1