Web Application Developer Security Advisory
The CERT Coordination Center, a federally funded research and development
center that provides Internet security incident response and training support, has
issued the CERT
Advisory CA-2000-02 titled "Malicious HTML Tags Embedded
in Client Web Requests". This advisory provides recommended programming
practices to mitigate the delivery of malicious content to users. A best practice for
application developers is to always "scrub" input from users. In other words, no web
application should ever output information supplied by a user without first checking
on that input.
Recommendations:
Web Application Developers: Read CERT
Advisory CA-2000-02. This advisory details programming practices
which can be used to lessen the risk of an attack against your application
through user input. Another useful document is its related Understanding
Malicious Content Mitigation For Web Developers which provides more
technical tips for web developers. However, it has been determined that the default response for HTTP error 404, "File not found" can be used as a mechansim for exploitation as described in the CERT
Advisory CA-2000-02. Recommended configurations to prevent such an attack can be found here.
Browser Users: More information on basic security issues
can be found at Understanding
Security and Privacy.
Web Server Administrators: The CERT Advisory states that you are "encouraged
to apply patches as suggested by your vendor to address this problem." There are
no patches required for the iPlanet(TM) Web Server products (formerly Netscape
Enterprise Server).
Additional links on security:
