🚀 go-pugleaf

In article <6cjasb$dfl@freenet-news.carleton.ca>,
Colin R. Leech <ag414@FreeNet.Carleton.CA> wrote:
>
>Forwarded from comp.internet.net-happenings:
>
>> Major Web Sites Vulnerable: Hidden "Hole" Behind
>> Far-reaching Internet Security Threat
>>            http://www.miora.com/

  If you read the fine print, you'll see that it has nothing to do with 
web *servers*, but *cgi-bin* programs.

>> According MSC's General Manager and Chief Consultant,
>> Michael Miora, CISSP, the problem, which has been
>> dubbed the MSC Hidden Form Field Vulnerability, has the
>> potential to undermine security at sites built with
>> software from Microsoft (NASDAQ: MSFT), Netscape
>> (NASDAQ:NSCP), Lotus, IBM (NYSE:IBM ), Apache, and
>> others. Also affected are so-called "middleware"
>> products that use HTML forms to access database information. 

  It's not the fault of the web server if some idiot cgi-bin programmer 
decides to put secret data in the "hidden" fields of a form.  Security 
through obscurity is always a dumb idea.

>> Working out of MSC's offices in Los Angeles,
>> penetration testing teams from MSC Labs were able to
>> exploit hidden form fields to break into client sites
>> during authorized tests.

  I really doubt that.  Did they gain shell access?

  What probably happened was that they discovered the names of "hidden" 
files by looking at the form source.  This isn't surprising news.

>> Brussin's report can be downloaded from the Miora
>> Systems Consulting web site at http://www.miora.com.
>> The report explains the main areas of concern, which
>> include: broken authentication systems; compromise of
>> sensitive information; new types of CGI program
>> attacks; plus hijacking and replay attacks enabling
>> malicious hackers to gain unauthorized access to
>> financial and medical systems. 

  i.e. All of these cgi-bins are broken and insecure.  Anyone writing 
secure cgi-bins should know to avoid these problems/

>> Using encryption technology, Brussin designed a method
>> to prevent subversion of hidden form fields.

  The "solution" involves the web server parsing ALL cgi-bin output for 
hidden fields, encrypting them, and then parsing the return values, and 
decrypting them.  Yuck.

  This has been discussed on the Apache developers list, and the 
consensus was "it's the cgi-bin developers problem.  Apache is fine."

  Another consensus was that it was an attempt by MSC to get free 
advertising.

  Alan DeKok.