bugtraq - Re: [DSECRG-09-009] APC PowerChute Network Shutdown's Web Interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 26 Feb 2009 22:15:50 +0100
From: Ansgar Wiechers <bugtraq@...netcobalt.net>
To: bugtraq@...urityfocus.com
Subject: Re: [DSECRG-09-009] APC PowerChute Network Shutdown's Web Interface - XSS vulnerability

On 2009-02-26 Vladimir '3APA3A' Dubrovin wrote:
> --Thursday, February 26, 2009, 7:40:50 PM, you wrote to bugtraq@...urityfocus.com:
> DSRG> Application:       APC PowerChute Network Shutdown's Web Interface
> DSRG> Vendor URL:        http://www.apc.com/
> DSRG> Bug:               XSS/Response Splitting
> 
> DSRG> Solution:          Use Firewall
> 
> Just wonder: how can firewall to protect against XSS/response splitting?

You don't give the bad guys access to your UPS's web interface?

Regards
Ansgar Wiechers
-- 
"The Mac OS X kernel should never panic because, when it does, it
seriously inconveniences the user."
--http://developer.apple.com/technotes/tn2004/tn2118.html