SecurityFocus

Bypassing of web filters by using ASCII Jun 21 2006 01:11PM
k huwig iku-ag de (4 replies)

Re: Bypassing of web filters by using ASCII Jun 22 2006 10:08PM
Amit Klein (AKsecurity) (aksecurity hotpop com)

Re: Bypassing of web filters by using ASCII Jun 22 2006 02:57PM
Hubert Seiwert (hubert westpoint ltd uk)

Re: Bypassing of web filters by using ASCII Jun 21 2006 11:57PM
RSnake (rsnake shocking com) (2 replies)

Re: Bypassing of web filters by using ASCII Jun 25 2006 03:42PM
David Huecking (d huecking gmx net)

Re: Bypassing of web filters by using ASCII Jun 22 2006 12:34AM
Kurt Huwig (k huwig iku-ag de)

Re: Bypassing of web filters by using ASCII Jun 21 2006 08:15PM
Fixer (fixer gci net) (1 replies)

Re: Bypassing of web filters by using ASCII Jun 21 2006 10:24PM
Paul (pvnick gmail com) (3 replies)

Re: Bypassing of web filters by using ASCII Jun 22 2006 07:46AM
Amit Klein (AKsecurity) (aksecurity hotpop com) (1 replies)

RE: Bypassing of web filters by using ASCII Jun 23 2006 11:55AM
James C. Slora Jr. (james slora phra com) (3 replies)

Re: Bypassing of web filters by using ASCII Jun 26 2006 05:56PM
Hubert Seiwert (hubert westpoint ltd uk) (1 replies)

RE: Bypassing of web filters by using ASCII Jun 26 2006 07:31PM
James C. Slora Jr. (james slora phra com)

Hubert Seiwert wrote Monday, June 26, 2006 1:57 PM

> I don't currently see how this "ascii vulnerability" would make code
> injection possible on webservers where the Content-Type is not
> US-ASCII already, as the 3 methods mentioned to change the charset
> (http-equiv content-type header, CSS @charset, document.charset)
> depend on being able to inject things already.

Agreed - the ASCII vulnerability doesn't make servers less secure. It
doesn't make user-agents less secure either, since nothing here has
exposed any new attack vectors. It merely introduces a big, glaring,
open way for hostile code to evade detection when delivered from hostile
servers or in served code that is already vulnerable to injection. Doing
this without XSS can further exploit site trust.

So while the merits of IE's US-ASCII rendering choice can be easily
debated, products that claim to help protect IE users by detecting
hostile code need to step up and cover the ASCII issue fully.

- Jim

[ reply ]

RE: Bypassing of web filters by using ASCII Jun 23 2006 10:12PM
RSnake (rsnake shocking com)

RE: Bypassing of web filters by using ASCII Jun 23 2006 07:23PM
Amit Klein (AKsecurity) (aksecurity hotpop com)

Re: Bypassing of web filters by using ASCII Jun 22 2006 03:40AM
Thor (Hammer of God) (thor hammerofgod com)

Re: Bypassing of web filters by using ASCII Jun 21 2006 11:23PM
Kurt Huwig (k huwig iku-ag de)