If I remember correctly, something similar demonstrated by someone(a bounty hunt... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

rikacomet on June 1, 2014 | parent | context | favorite | on: CVE-2014-3466: GnuTLS buffer overflow

If I remember correctly, something similar demonstrated by someone(a bounty hunter) a few months back, and was featured on HN front page as well.

I remember it was maybe related to Facebook, and not to TLS/SSL specifically. Very similar.. sending excessively long session id values.

I wonder if excessively long session id values can break something else as well?

farness on June 1, 2014 [–]

Excessively long data is a cornerstone of security vulnerabilities.

> I wonder if excessively long session id values can break something else as well?

Yes, with p~=1.

rikacomet on June 1, 2014 | [–]

Indeed it is, but what I was curious to know more about the particular case of session IDs.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact