Some systems are configured out of the box to allow acess to all configured resources unless a rule is put in place to block access. I can't think a webserver that doesn't enforce this as its basic policy. All all by default unless told otherwise.

Other systems default closed. Some firewalls, especially the simple home-user ones come with a default configuration that denies-all.

I'm not sure that failing open is really whats happening here. A webserver is designed to serve up traffic. It is designed to allow access to the contents of the webserver unless told otherwise.

While we can argue whether vendors should alow their base authorization rule engine default-deny or default-allow, it isn't clear to me in this case that this is really a standard case of failing open.

Its a bug in the authorization handler, but not a bug in the security logic.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/285/29646#29646