From: coderman (codermangmail.com)
Date: Tue Jun 19 2007 - 16:54:28 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On 6/19/07, Valdis.Kletnieksvt.edu <Valdis.Kletnieksvt.edu> wrote:
> ...
> I'm tempted to take that bet. Lot of people have thrown lots of truly wild
> stuff at the Apache code over the years - it may react in *unexpected* ways,
> but it's probably pretty bulletproof.

agreed.

> On the other hand, that little webserver admin tool that's stuffed into one
> corner of your DSL modem's ROM probably got tested ... with little to no
> serious abuse of the interface.

absolutely. i didn't mean to imply that embedded and lightweight
webservers were more robust, they surely aren't. only that they would
be much less likely to interpret arbitrary unprintable characters in a
request as valid.

in particular, buffer overflows are not uncommon for embedded devices,
like those who don't expect a request URL to exceed 1024 characters,
etc...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]