Security

Closing off cross-site scripting holes

When writing web applications, it is easy to lose track of the fact that HTML is not quite the same as plain text. As a result, erroneous characters (such as an unescaped "&") can easily slip into a web page. They can result in poorly rendered pages, RSS files that fail to load, and lots of email suggesting that the author buy and read a copy of "HTML for drooling morons." Trust us, we know.

As annoying as that sort of problem can be, it fades into insignificance when compared to the other issue that arises when text is treated as if it were HTML: cross-site scripting. If an outside attacker can get your web application to present arbitrary HTML to another user, that attacker can often get the victim to disclose information or carry out an unwanted action. Cross-site scripting problems have afflicted many applications, and they are unlikely to go away anytime soon. It is just too easy for a web application programmer to slip up and let untreated text slip through.

Version 0.6 of the Quixote web application framework, which saw its first beta release last week, includes an interesting approach to the cross-site scripting problem. Quixote (which is the framework used by LWN) includes a nice "template" feature which allows an easy and natural mixing of HTML text and Python code. Text generated by a template is passed back to the web browser as an HTML document. In the current Quixote release, as in most web frameworks, text is sent directly back without processing or quoting. After all, web templates need to be able to include HTML tags in their output, and things would not work very well if those tags were quoted. Quixote provides a function for the safe quoting of untrusted text, but the programmer must remember to use it in all the relevant places. Sooner or later, most programmers forget.

Version 0.6, instead, has two kinds of text. Anything which appears in a literal, quoted string is of type "htmltext," and it is assumed to be exactly as the programmer wanted it to be (since he or she wrote it that way). Anything which takes the form of an ordinary Python string, however, is assumed to need quoting on its way to the browser; this quoting happens automatically as the template is executed.

The result is that text that comes from a database or other external source is automatically quoted, and thus can not be used for a cross-site scripting attack. The programmer no longer needs to worry about quoting every bit of text that passes through the application. This is, of course, the way things should be done from a security standpoint. Assume that everything is suspect in the absence of an explicit statement to the contrary. This approach, too, can create bugs - HTML tags may end up being quoted when they should be passed through directly. But that kind of bug is immediately evident, while a failure to quote is usually invisible - until it bites you. The new Quixote HTML template mechanism errs on the side of security and makes failures happen in the right way.

Comments (4 posted)

ethereal - Various security issues in Ethereal

Package(s):	ethereal	CVE #(s):	CAN-2002-1355 CAN-2002-1356
Created:	January 9, 2003	Updated:	January 14, 2003
Description:	Ethereal is a package designed for monitoring network traffic on your system. Several security issues have been found in the Ethereal packages. Multiple integer signedness errors in the BGP dissector in Ethereal 0.9.7 and earlier allow remote attackers to cause a denial of service (infinite loop) via malformed messages. This problem was discovered by Silvio Cesare. CAN-2002-1355 Ethereal 0.9.7 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed packets to the LMP, PPP, or TDS dissectors. CAN-2002-1356 Users of Ethereal should update to the erratum packages containing Ethereal version 0.9.8 which is not vulnerable to these issues.
Alerts:	Red Hat RHSA-2002:290-07 ethereal 2003-01-08

Comments (none posted)

IMP - SQL injection vulnerability

Package(s):	imp	CVE #(s):	CAN-2003-0025
Created:	January 15, 2003	Updated:	July 8, 2003
Description:	The IMP IMAP server, versions 2.2.8 and prior, is vulnerable to SQL injection; see this advisory for details. Version 3.x is not vulnerable to this problem.
Alerts:	Conectiva CLA-2003:690 imp 2003-07-08 SuSE SuSE-SA:2003:0008 imp 2003-02-18 Debian DSA-229-2 imp 2003-01-15

Comments (1 posted)

mod_php - buffer overflow

Package(s):	mod_php php	CVE #(s):	CAN-2002-1396
Created:	January 13, 2003	Updated:	February 20, 2003
Description:	The wordwrap() function on user-supplied input may allow a specially-crafted input to overflow the allocated buffer and overwrite the heap. There are no known exploits, but an exploit is theoretically possible. Read the full advisory at http://marc.theaimsgroup.com/?l=bugtraq&m=104102689503192&w=2
Alerts:	Mandrake MDKSA-2003:019 php 2003-02-19 EnGarde ESA-20030219-003 php 2003-02-19 Red Hat RHSA-2003:017-06 PHP 2003-02-04 OpenPKG OpenPKG-SA-2003.005 php, apache 2003-01-22 Gentoo 200301-8 mod_php 2003-01-13

Comments (none posted)

OWASP Identifies Ten Most Critical Web Application Security Vulnerabilities

The Open Web Application Security Project has announced the release of its report on the top ten security vulnerabilities to be found in web applications. Worthwhile reading for anybody involved in the creation of these applications.

Comments (none posted)

Old hard drives yield data bonanza (News.com)

Here's a News.com article reminding us of the security risks of old disk drives. "You pick up 10 drives on the used market and the chances are that three or four of them are going to have confidential information."

Comments (none posted)