Re: [Full-disclosure] IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])

To: eaton.lists@xxxxxxxxx, psz@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])
From: Paul Szabo <psz@xxxxxxxxxxxxxxxxx>
Date: Tue, 3 Oct 2006 13:15:13 +1000
Cc: bugtraq@xxxxxxxxxxxxxxxxx, full-disclosure@xxxxxxxxxxxxxxxxx
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

Seems that I was wrong and Brian Eaton <eaton.lists@xxxxxxxxx> was right:
default apache installations seem to return an explicit charset in their
error message. (Now I cannot explain how I convinced myself otherwise.)
Then there is no Universal XSS against default Apache webservers...

Cheers,

Paul Szabo   psz@xxxxxxxxxxxxxxxxx   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

Prev by Date: Security flaw in IBM Client Security Password Manager
Next by Date: PacSec 2006 Papers announcement and EUSecWest Call For Papers
Previous by thread: Security flaw in IBM Client Security Password Manager
Next by thread: PacSec 2006 Papers announcement and EUSecWest Call For Papers
Index(es):
- Date
- Thread