[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[cobalt-security] Fwd: RE: Cobalt RaQ Control Panel Cross Site Scripting
- Subject: [cobalt-security] Fwd: RE: Cobalt RaQ Control Panel Cross Site Scripting
- From: Bruce Timberlake <bruce@xxxxxxxxxx>
- Date: Mon, 6 Oct 2003 10:56:34 -0700
- Organization: BRTNet.org
- List-id: Mailing list for users to address network security on Cobalt products. <cobalt-security.list.cobalt.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
FYI, from bugtraq
- ---------- Forwarded Message ----------
Subject: RE: Cobalt RaQ Control Panel Cross Site Scripting
Date: Saturday 04 October 2003 18:04
From: "Steve Manzuik" <steve@xxxxxxxxxxxxxxxx>
To: "Lorenzo Hernandez Garcia-Hierro" <lorenzohgh@xxxxxxxxxxxxxxxxx>,
"Bugtraq" <bugtraq@xxxxxxxxxxxxxxxxx>
> it is a security hole because it demonstrates that the message.cgi script
> does not have an input validation system.
This isn't a security hole but more of a scripting mistake. You don't gain
any additional access, you don't r00t the box, you don't even steal another
users session. Common best practices would tell anyone worth their wage to
enable SSL and not allow access to TCP 444 (the control panel interface
default port) to the outside anyways.
I fail to see how there is anything exploitable here.
- -S
- -------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE/gazSvLA2hUZ9kgwRAhuVAKCAMieB1VLG+o8yyXiozbdB2e+TpQCcDcuh
8381LW1xhUvm5xieRsFRy2s=
=UgeE
-----END PGP SIGNATURE-----