Re: Apache http server 2.0
Also, the characters
,./\[]-!`~@#$%^=+()-{}<>;:| '"
are also used in regular expressions. That might have something to do with
it.
-Justin
GHA - http://gha.bravepages.com
> ----- Original Message -----
> From: "Kim De Smaele" <kim.de.smaele@pandora.be>
> To: <bugtraq@securityfocus.com>
> Cc: <debian-security@lists.debian.org>
> Sent: Friday, April 25, 2003 5:20 PM
> Subject: Apache http server 2.0
>
>
> > Hi all,
> >
> > I experienced a very strange apache responce today in our production
> > environment at work. A user in a discussion room a posting containing
> > the following characters:
> >
> > ,,''
> >
> > This gave the result that several pages could not longer be displayed.
> > I also tried this on search engine http://www.google.com which gave the
> > same result. Nothing of results and not even the message "no results
> > found..." could be display. If you even keep on refreshing you will
> > notice that also the google logo will disappear.
> > On our servers, we didn't notice anything in the logs.
> >
> > I have done a test with several browsers and I had every time the same
> > result as described above:
> >
> > Internet Explorer
> > Netscape (windows)
> > Mozilla (Linux)
> > Opera (Linux)
> >
> > Personally I'm not sure but I'm getting the idea that this might me
> > exploitable. For example, executing code/commands after using the
> > characters as mentioned above followed by the code or the commands in a
> > search engine, discussion rooms,...
> >
> > Kind regards,
> >
> > Kim De Smaele
> >
> >
> > --
> > To UNSUBSCRIBE, email to debian-security-request@lists.debian.org
> > with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org
> >
> >
>
Reply to: