[cobalt-security] RE: Gareth's NT and FrontPage note and the Sun Response WRT FrontPage

["Michael J. Cannon" <mcannon@xxxxxxxxxxxxxx>]

Bottom line, ChiliSoft and the effects are imposing a 'behaviour' on Apache
and other server systems that is decidedly and provably insecure and dumb,
for the sake of user 'convenience.'

It opens holes in Apache and other systems it is applied to that have been
exploited in the past and will be exploited in the future.  Check ARIS,
dshield and CVE/CAIDA for records.

It's a dumb idea and anyone using it deserves what they get.  Sun's
allegation that they don't use FrontPage 'extensions' is a red herring.
They impose an inherently insecure behaviour on a system.  The black hats
are aware of it and plotting as we speak.  I think it will be far less than
a month before we see the first FrontPage and Apache attacks.

As to the comment on NT and Code Red, that was true until Sunday.  It is not
now.

Mike