Re: Insecure XML-RPC handling in Zope reveals the distribution physic al location.

From: BlueRaven (blueravenat_private)
Date: Mon Oct 07 2002 - 01:26:37 PDT

Next message: Andrew Hodgson: "Filters on url shortening services"

Previous message: EnGarde Secure Linux: "[Full-Disclosure] [ESA-20021007-024] apache: potential DoS, cross-site scripting, and buffer overflow vulnerabilities."
In reply to: Rossen Raykov: "Insecure XML-RPC handling in Zope reveals the distribution physic al location."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Tue, Oct 01, 2002 at 09:57:27AM -0400, Rossen Raykov wrote:

> A request like the quoted below will cause Zope to produce stack traces in
> the response that will reveal the information mentioned above.

The same is if you try to access the manage interface and, after a failed
login, click Cancel: the stack trace includes the full path infos.
Verified on a 2.5.1 (stable) installation.

-- 
BlueRaven

There are only 10 types of people in this world...
those who understand binary, and those who don't.

Next message: Andrew Hodgson: "Filters on url shortening services"
Previous message: EnGarde Secure Linux: "[Full-Disclosure] [ESA-20021007-024] apache: potential DoS, cross-site scripting, and buffer overflow vulnerabilities."
In reply to: Rossen Raykov: "Insecure XML-RPC handling in Zope reveals the distribution physic al location."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Oct 07 2002 - 11:59:51 PDT