On Wed, Oct 23, 2002 at 11:32:53AM +0200, Courtin Bert wrote: > is there any information available regarding the mentioned > potential Cross-Side-Scripting bug? > (Any CERT/CC Advisory CA-xxxxx, BUGTRAQ-Messages etc...)
Hi, here are the details: Versions of mod_ssl older than 2.8.12 suffer from a cross-site- scripting bug: mod_ssl will send the server name unescaped in the response to an HTTP request on an SSL port. This issue has been assigned CVE CAN-2002-1157. Like the other recent Apache XSS bugs, this only affects servers using a combination of "UseCanonicalName off" (not the default in 1.3) and wildcard DNS. Apache 2.0/mod_ssl is not vulnerable since it already escapes this HTML. Regards, joe -- Joe Orton, Red Hat Europe, Stronghold Engineering http://stronghold.redhat.com/ ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
