MOAB 7 (and 6)

[Landon Fuller]

http://projects.info-pull.com/moab/MOAB-07-01-2007.html

I'm thinking patch -[WebFrameBridge
runJavaScriptAlertPanelWithMessage:], with % escaping, same as
Finlay's iPhoto fix.

Also, I have a fix put together for MOAB 6, but I'd really like some
code review; I'll post the patch in a bit.

-landonf

[Landon Fuller]

On Jan 7, 2007, at 11:31 AM, Landon Fuller wrote:

> http://projects.info-pull.com/moab/MOAB-07-01-2007.html
>
> I'm thinking patch -[WebFrameBridge
> runJavaScriptAlertPanelWithMessage:], with % escaping, same as
> Finlay's iPhoto fix.

Er, -[OWTab(WebUIDelegate) webView:runJavaScriptAlertPanelWithMessage:]
Rosyna pointed out that WebFrameBridge is in WebKit.

-landonf

[Finlay Dobbie]

And as further clarification, this issue is specific to OmniWeb - it
is not "actually breaking WebKit" as claimed in the advisory. Shiira
is also not vulnerable, fwiw.

-- Finlay

[mart...@gmail.com]

really tired of this BS, again this is not an Apple bug.

MOAB = MOB = a thousand other bugs in this category.

he is not sticking to his original concept.

[Rosyna]

You assume there was an original coherent concept and that they had a
plan that matched your expectations. ;-)

Ack, at 1/7/07, mart...@gmail.com said:

>he is not sticking to his original concept.

--

Sincerely,
Rosyna Keller
Technical Support/Carbon troll/Always needs a hug

Unsanity: Unsane Tools for Insanely Great People

It's either this, or imagining Phil Schiller in a thong.

[Eric Hall]

And OmniWeb 5.5.2 (released today I believe) is not vuln. to
MOAB 7. 5.5.2-beta4 was (tried it first).

-eric

[Eric Hall]

On Mon, Jan 08, 2007 at 05:18:38AM +0000, Eric Hall wrote:
[snip]

>
> And OmniWeb 5.5.2 (released today I believe) is not vuln. to
> MOAB 7. 5.5.2-beta4 was (tried it first).
>

And now I see I'm *way* behind for the day.

Nothing to see here, move along, move along.

[missileboat]

{yawn} So where are the super nasty bugs? All I am seeing so far are
cute, fuzzy willy worms that likewise get run over by a car soon after
setting foot on the road...

Steven

[Jens Ayton]

martijn.s:

>
> really tired of this BS, again this is not an Apple bug.
>
> MOAB = MOB = a thousand other bugs in this category.
>
> he is not sticking to his original concept.

MoAB FAQ #3 (http://projects.info-pull.com/moab/):

Are Apple products the only one target of this initiative?

Not at all, but they are the main focus. We'll be looking over
popular OS X applications as well.

The threshold for "popular" as it relates to OmniWeb, VLC and Adobe
Reader is of course open to debate. :-)

However, I think Adobe Reader < 8 is quite likely to be widely
deployed, because:
a) Typical users are likely to believe web sites that say they "need"
Adobe Reader to read PDFs.
b) Typical users tend to ignore/avoid/fear updates.
c) Typical users suffer from significant inertia, and many are used to
Adobe Reader/Acrobat.

On the other paw, this category of users are unlikely to be applying
third-party bug-fix APEs.

As a side note, it's pretty obvious, but I haven't noticed anyone
mentioning it, so: PDF parsing bugs affecting Adobe Reader are likely to
affect Acrobat (pro) and quite likely other Adobe apps, too.

--
Jens Ayton

Sed quis custodiet ipsos custodes?