Cross-Site-TRACE

quackking writes "Uh-oh! Looks bad for RFC 2068! Kudos to WhiteHat out of Santa Clara, CA for this one. ALL current web servers comply with this RFC, which means they ALL are vulnerable to this newly named attack - XST - cross-site-trace. When misused, TRACE, part of the HTTP protocol, allows an unauthorized script to be passed to a Web server for execution even if the server is secured against running such scripts. Even devices like web-managed routers are open to this."

Comments

obligatory /.-ted remark

[selderrr]

highly popular blog
apparenlty a bit to popular right now:-)

Return to Pleasure Island

[AndroidCat]

Got his little chapbook right here, signed even. And if you flip though the pages, the donkey changes into a boy, or is that the other way around?

How could this happen?

[Anonymous Coward]

I thought the Magic Kingdom was the happiest place on earth? If you cry Mickey will give you free gifts.

Re:why would i buy?

[gotroot801]

For that matter, why wouldn't I buy the book, when the dead-tree edition would probably reach me quicker than the free download on the slashdotted server? :)

Re:Most science fiction

[Anonymous Coward]

You must be a liberal, based on your use of an ad-hominem attack rather than actually trying to refute something you don't agree with :-)

Rush Limbaugh is a liberal?!

Re:Most science fiction

[bdr1]

rather than just sitting there like a turd on a log, belching out criticism, write your own novel. otherwise, stop your croaking.

Descriptivism R teh suX0R, lol urfuct

[Anonymous Coward]

Preaching to the choir, half of whom are asleep and the other half can't sing. The pews are empty. You GO, boy.

/!\ Security Alert _ [] [X]

[Seehund]

Your Computer Is Currently Broadcasting An
Internet IP Address. With This Address, Someone Can
Immediately Begin Attacking Your Computer! [ OK ]

Shut up Slashdot. I get all the Security Alerts I need from media*.fastclick.net.

Re:relation?

[LinuxPunk]

Oh my god, they killed UUnet! Those bastards!

Sprint seems to be doing very well, though.

At least...

[mraymer]

...they didn't provide a link to an example script for this exploit. ;)

Can you imagine the royal slashdotting that RIAA/MPAA/MS/etc would receive if the thousands of script kiddies that read /. suddenly had access to such a thing?

Perhaps this is what Obi-Wan was talking about when he felt the tremor in the force, and the whole Alderaan blowing up thing was just a bizarre coincidence...

Re:relation?

[hudmond]

excerpt taken from http://www.internet.com/

Microsoft Promises a More Secure 2003 After a year of working on its security issues, the company's Trustworthy Computing initiative is taking more of a 'push' approach starting with Windows Server 2003. -internetnews

Anyone else find this laughable? I'm slightly entertained I'll admit.

Re:relation?

[amigaluvr]

hrm kevin mitnick is allowed back o the net and the net goes fubar

hrmmmmmmmmmmmmmmm????

Ironic...

[weave]

/. runs a story on main page about huge security hole in all web servers that will bring the net to its knees, but it really only affects IE clients. They don't run a story about what may end up the biggest net story of the year, ala code red, the MS SQL worm running wild on the net now and shutting down entire sites and playing havoc with the backbone.

/. posters work around the damage in the story and start posting comments en masse about the SQL attack -- the real story this day -- leaving people who lack reading comprehension to confuse the two issues, therefore causing a DDOS on their brain.

Maybe it's bin laden

[FIGJAM]

lets blame him anyway

Re:This story is crap

[eyeball]

This story is utter alarmist crap.

Hey, don't knock alarmist crap. It's a real cash cow for some people!