Deepak Bhole discovered a flaw in the Same Origin Policy (SOP) implementation in the IcedTea project Web browser plugin. A malicious applet could use this flaw to bypass SOP protection and open connections to any sub-domain of the second-level domain of the applet's origin, as well as any sub-domain of the domain that is the suffix of the origin second-level domain. For example, IcedTea-Web plugin allowed applet from some.host.example.com to connect to other.host.example.com, www.example.com, and example.com, as well as www.ample.com or ample.com.
Created attachment 526854 [details] Proposed patch from Deepak / Omair
Created attachment 530174 [details] patch to correct the flaw in IcedTea-Web This is the patch that will be used in the upstream release.
Created attachment 531362 [details] patch for icedtea6 1.8
Created attachment 531363 [details] patch for icedtea6 1.9
This is now public: http://dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released/
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:1441 https://rhn.redhat.com/errata/RHSA-2011-1441.html