[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])
- To: eaton.lists@xxxxxxxxx, psz@xxxxxxxxxxxxxxxxx
- Subject: Re: [Full-disclosure] IE UXSS (Universal XSS in IE, was Re: Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053])
- From: Paul Szabo <psz@xxxxxxxxxxxxxxxxx>
- Date: Tue, 3 Oct 2006 13:15:13 +1000
Seems that I was wrong and Brian Eaton <eaton.lists@xxxxxxxxx> was right:
default apache installations seem to return an explicit charset in their
error message. (Now I cannot explain how I convinced myself otherwise.)
Then there is no Universal XSS against default Apache webservers...
Cheers,
Paul Szabo psz@xxxxxxxxxxxxxxxxx http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics University of Sydney Australia