[EMAIL PROTECTED] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks

2008-01-23 Thread Lindsay Hausner
FYI http://www.securitytracker.com/alerts/2008/Jan/1019256.html lh.. - The official User-To-User support forum of the Apache HTTP Server Project. See URL:http://httpd.apache.org/userslist.html for more info. To unsubscribe,

Re: [EMAIL PROTECTED] Apache mod_negotiation Input Validation Hole Permits Cross-Site Scripting Attacks

2008-01-23 Thread Joshua Slive
On Jan 23, 2008 12:39 PM, Lindsay Hausner [EMAIL PROTECTED] wrote: FYI http://www.securitytracker.com/alerts/2008/Jan/1019256.html What's your point? The Apache httpd developers don't consider this a vulnerability because it can only be exploited if you can write arbitrary filenames to the