Raph, Orion will return a 404 error if you request a resource which is not availble, for example, a non-existing html.
If you request http:///c:|mydirectory/nonexistantfile.txt, orion will just return 404. I know, because there are many attacks on my website all the time with a similar strategy. Orion does not return the request, and javascript is not executed on the orion server. However, if you are using IIS as a web server front end to Orion, you are absolutely vulnurable to this attack....but its not orion, its IIS which is being hijacked. If you are using Apache as a front end, there should be no problem. Regards, the elephantwalker www.elephantwalker.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Raphael Gillett Sent: Friday, December 07, 2001 12:24 PM To: Orion-Interest Subject: Security Vulnerability? Dear Everyone, A recent security scan of a Windows 2000 network identified the following vulnerability on an Orion 1.5.2 server. "The remote host seems to be vulnerable to the Cross Site Scripting vulnerability. The vulnerability is caused by the result returned to the user when a non-existing file is requested (e.g. the result contains the JavaScript provided in the request). The vulnerability would allow an attacker to make the server present the user with the attacker's JavaScript/HTML code. Since the content is presented by the server, the user will give it the trust level of the server (for example, the trust level of banks, .... ) ...... " I have 2 questions: 1. Is this information about Orion 1.5.2 actually correct ? 2. If yes, is the vulnerability resolved in 1.5.3 ? Regards, Raph
