Re: [CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-12 Thread Proxy One
On 2015-Aug-11 19:57, Ellen Shull wrote: On Tue, Aug 11, 2015 at 4:46 AM, Proxy One proxy-...@mail.ru wrote: I haven't used Location /perl-status but Trustwave still finds me vulnerable. [...] Response: HTTP/1.1 404 Not Found You clearly aren't serving perl-status; that's a red

Re: [CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-12 Thread Proxy One
On 2015-Aug-12 07:36, Eero Volotinen wrote: How about something like: Location /perl-status # disallow public access Order Deny, Allow Deny from all Allow from 127.0.0.1 SetHandler perl-script PerlResponseHandler Apache2::Status /Location

Re: [CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-12 Thread Прокси
On 2015-Aug-12 05:17, Ellen Shull wrote: On Wed, Aug 12, 2015 at 3:39 AM, Proxy One proxy-...@mail.ru wrote: Is there way to use curl for testing? I'm getting new line because of the single quote inside string and escaping it with back slash gives me bash: syntax error near unexpected token

Re: [CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-12 Thread Ellen Shull
On Wed, Aug 12, 2015 at 3:39 AM, Proxy One proxy-...@mail.ru wrote: Is there way to use curl for testing? I'm getting new line because of the single quote inside string and escaping it with back slash gives me bash: syntax error near unexpected token `' You can use curl's -K option which lets

[CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-11 Thread Proxy One
Hello, I've failed latest PCI scan because of CVE-2009-0796. Centos 6.7. The Red Hat Security Response Team has rated this issue as having moderate security impact and bug as wontfix. Explanation: The vulnerability affects non default configuration of Apache HTTP web server, i.e cases, when

Re: [CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-11 Thread Ellen Shull
On Tue, Aug 11, 2015 at 4:46 AM, Proxy One proxy-...@mail.ru wrote: I haven't used Location /perl-status but Trustwave still finds me vulnerable. [...] Response: HTTP/1.1 404 Not Found You clearly aren't serving perl-status; that's a red herring here. [...] Body: contains

Re: [CentOS] Apache mod_perl cross site scripting vulnerability

2015-08-11 Thread Eero Volotinen
How about something like: Location /perl-status # disallow public access Order Deny, Allow Deny from all Allow from 127.0.0.1 SetHandler perl-script PerlResponseHandler Apache2::Status /Location 2015-08-11 14:46 GMT+03:00 Proxy One proxy-...@mail.ru: