Deepak Bhole discovered a flaw in the Same Origin Policy (SOP) implementation in the IcedTea project Web browser plugin. A malicious applet could use this flaw to bypass SOP protection and open connections to any sub-domain of the second-level domain of the applet's origin, as well as any sub-domain of the domain that is the suffix of the origin second-level domain. For example, IcedTea-Web plugin allowed applet from some.host.example.com to connect to other.host.example.com, www.example.com, and example.com, as well as www.ample.com or ample.com.
Created attachment 526854 [details]
Proposed patch from Deepak / Omair
Created attachment 530174 [details]
patch to correct the flaw in IcedTea-Web
This is the patch that will be used in the upstream release.
Created attachment 531362 [details]
patch for icedtea6 1.8
Created attachment 531363 [details]
patch for icedtea6 1.9
This is now public:
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2011:1441 https://rhn.redhat.com/errata/RHSA-2011-1441.html