Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cross-Site-TRACE

Posted by michael on from the uh-oh dept.

quackking writes "Uh-oh! Looks bad for RFC 2068! Kudos to WhiteHat out of Santa Clara, CA for this one. ALL current web servers comply with this RFC, which means they ALL are vulnerable to this newly named attack - XST - cross-site-trace. When misused, TRACE, part of the HTTP protocol, allows an unauthorized script to be passed to a Web server for execution even if the server is secured against running such scripts. Even devices like web-managed routers are open to this."

3 of 299 comments (clear)

  1. are you stupid enough to subscribe to slashdot? by Anonymous Coward · · Score: -1, Troll

    If you are dumb enough to pay these assholes to post 2 day old news with plenty of spelling errors and their open sores propaganda, then you are just the person I am looking for. I have a great financial opportunity for you in Nigeria...

  2. Kudos to my cock by Anonymous Coward · · Score: -1, Troll

    For being the first one into your ass

  3. stuff by floamy · · Score: -1, Troll

    does announcing big security vulnerabilities really help everyone stay safe?