Re: False Positive in cross_site_scripting.nasl

From: Pavel Kankovsky (peakat_private)
Date: Sun Mar 03 2002 - 08:28:06 PST

Next message: Noam Rathaus: "Fw: ereg_replace problem"

Previous message: Noam Rathaus: "Re: SMTP Relay Diffs"
In reply to: Andrew Hintz (Drew): "False Positive in cross_site_scripting.nasl"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, 1 Mar 2002, Andrew Hintz (Drew) wrote:

> HTTP/1.1 404 /<SCRIPT>alert('Vulnerable')</SCRIPT>
> Content-Type: text/html
> Date: Fri, 01 Mar 2002 21:34:28 GMT
> Server: Apache Tomcat/4.0.1 (HTTP/1.1 Connector)
> Connection: close

I don't think this is a false positive per se. At least until all software
vendors (including a certain major one) stop their quest for new and novel
harmful ways how to interpret untrusted data.

Perhaps the plugin should generate two kinds of messages: one for
occurences in the body (hole) and another for occurences in the header
(warning).

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

Next message: Noam Rathaus: "Fw: ereg_replace problem"
Previous message: Noam Rathaus: "Re: SMTP Relay Diffs"
In reply to: Andrew Hintz (Drew): "False Positive in cross_site_scripting.nasl"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Sun Mar 03 2002 - 10:17:22 PST