OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Henning Brauer (henning_at_cvs.openbsd.org)
Date: Fri Oct 04 2002 - 06:29:53 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    CVSROOT: /cvs
    Module name: src
    Changes by: henningcvs.openbsd.org 2002/10/04 05:29:53

    Modified files:
            usr.sbin/httpd/src/main: http_core.c

    Log message:
    fix a cross-site scripting vuln:
    *) SECURITY: CAN-2002-0840 (cve.mitre.org)
    Prevent a cross-site scripting vulnerability in the default
    error page. The issue could only be exploited if the directive
    UseCanonicalName is set to Off and a server is being run at
    a domain that allows wildcard DNS. [Matthew Murphy]