This bug is a fascinating lesson in how adding restrictions with the aim of improving security may paradoxically end up reducing it.
Source: Sophos