[Xitami] Security Issue - Disabling Script Processing

[Rob @ BMM]

I suspect there are several ways to potentially address this problem within
Xitami using some configuration elements, I just need some guidance.

After reading the Xitami manual, potential options are as follows:

1..Disable Script Processing parameter if applicable in this case.
2..Filters - I don't know exactly what these are but...
3..Various CGI options like defining strings to help detect CGI and then
disabling them all together.

Am I on the right track here.

Best Regards,
Rob Allen
President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
See us at http://www.BlueMarbleMeds.com

-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of Ewen McNeill
Sent: Tuesday, January 14, 2003 12:51 PM
To: xitami@lists.xitami.org
Subject: Re: [Xitami] Security Issue - Disabling Script Processing


In message <DGEHJCCICENINLMJDFGPIELICEAA.Rob@BlueMarbleMeds.com>, "Rob @
BMM" wr
ites:
>What this issue pertains to, is that Xitami allows this kind of script
>processing to occur.  I need a method to prevent it from occurring within
>Xitami.  Xitami should NOT allow paths outside of the local web folder
>environment which these kinds of hacks take advantage of.

Actually ISTR the issue is that the URL is invalid in a way that
triggers a bug in IIS and a security issue; and that invalid URL causes
Xitami's URL parsing to say "oh, you want the home page of the domain,
oaky, here it is".  So the 200 reply is Xitami sending out the home
page.

Short of a bug-fixed version of Xitami (I've no idea when/if there will
be another update; I just look after the computers these days), about
the best idea I have for avoiding a 200 reply is to password protect
the URL's top path -- and I'm not even sure if that will work due to
the parsing issues mentioned above.

Ewen

--
Ewen McNeill, System Administrator, iMatix Corporation  www.imatix.com

--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami