Comment 27 for bug 1449212

Hi Jeremy,

I think in addition, the discussions that resulted in me reporting this bug exposed a second vulnerability with account level temp URLs that has been around for a while.

Where someone with a account level PUT temp URL could potentially probe for existing objects by created DLO that references other containers/objects and HEADING the DLO created. If they had a pair of account level PUT/GET temp URLs, could additionally retrieve data from any object found.

I am not sure who first figured it out, but Sam Merritt was I think the first person to explain it such that I understood this aspect of it.