BugTraq
Back to list
|
Post reply
Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability
May 14 2008 05:20PM
Tom Donovan acm org
(1 replies)
Setting the HTTP response header:
Content-Type: text/html; charset=iso-8859-1
or adding the tag:
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
or even both - still does not deter IE from scanning the contents and interpreting them as UTF-7 when Encoding=Auto-Select.
(observed on w2k with IE 6.0.2800.1106 SP1 + Q867801 + Q823353 + Q833989 + Q903235)
It appears there is little that web servers can do to thwart this, short of changing all '+' characters to %2B. That seems excessive.
-tom-
[ reply ]
Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability
May 16 2008 09:44AM
Jon Ribbens jon+bugtraq2 (at) unequivocal.co (dot) uk [email concealed] (jon+bugtraq2 unequivocal co uk)
Privacy Statement
Copyright 2010, SecurityFocus
Content-Type: text/html; charset=iso-8859-1
or adding the tag:
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
or even both - still does not deter IE from scanning the contents and interpreting them as UTF-7 when Encoding=Auto-Select.
(observed on w2k with IE 6.0.2800.1106 SP1 + Q867801 + Q823353 + Q833989 + Q903235)
It appears there is little that web servers can do to thwart this, short of changing all '+' characters to %2B. That seems excessive.
-tom-
[ reply ]