[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: NYT on Netscape Crack



> 	Don't forget system(), which was a major source of holes in the NCSA server.  
> Also, CGI scripts, especially those that run under perl or sh, would be a good 
> place to look for holes.  Don't forget to see what happens when you put 
> semi-colons in the data field of various fields, such as mailto:'s.
> 

	A CGI-script hole doesn't count as a netscape server hole.
system() is probably pretty bad though. 

-- 
sameer						Voice:   510-601-9777
Community ConneXion				FAX:	 510-601-9734
An Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.org (or login as "guest")			[email protected]