ITinfo: Cross-Site Scripting Security Bug Hits the Web

Site Directory
Membership
Train-the-Trainer
Trainer Certification
Certified Training Materials
ITinfo E-zine
Responsible Training
White Papers
Trainer Resources
What's New
Speaking Engagements
Onsite Training
ITrain Gear

New Security Headache

Hidden holes for hackers

ITinfo Sponsor

ERROR: Random File Unopenable

The random file, as specified in the $random_file perl variable was unopenable.

The file was not found on your file system. This means that it has either not been created or the path you have specified in $trrandom_file is incorrect.

Cross-Site Scripting Security Bug Hits the Web

by Dave Murphy
ISSN 1535-3613

A new security threat that puts all web users at significant risk has been describe in a security alert posted by the CERT Coordination Center, hosted by Carnegie-Mellon Software Engineering Institute and the Internet's most recognized security authority.

CERT described in it's alert how a website may inadvertently include malicious HTML tags or a script in a dynamically generated webpage that can be based on unvalidated input from untrustworthy sources.

This can be a problem when an Internet web server does not adequately ensure that generated pages are properly encoded to prevent unintended execution of scripts, and when input is not validated to prevent malicious HTML from being presented to the user.

Most web browsers have the capability to interpret scripts embedded in webpages. Such scripts may be written in a variety of scripting languages and are run by the client's browser. Most browsers are installed with the capability to run scripts enabled by default.

When a victim with scripts enabled in their browser reads this message, the malicious code may be executed unexpectedly. Scripting tags that can be embedded in this way include <SCRIPT>, <OBJECT>, <APPLET>, and <EMBED>.

In addition to scripting tags, other HTML tags such as the <FORM> tag have the potential to be abused by an attacker. For example, by embedding malicious <FORM> tags at the right place, an intruder can trick users into revealing sensitive information by modifying the behavior of an existing form. Other HTML tags can also be abused to alter the appearance of the page, insert unwanted or offensive images or sounds, or otherwise interfere with the intended appearance and behavior of the page.

This vulnerability is unusual because it's not limited to software from any one particular vendor. All web browsers on any type of operating system are at risk.

Call for Comments

What do you think? Leave your comments on the message center.

References

CERT Advisory
Microsoft Security Site
Apache CSS Info
Message Center

Previous issues are on our website at http://itrain.org/itinfo/.

International Association of Information Technology Trainers
PMB 616
6030-M Marshalee Dr
Elkridge, MD 21075-5987

410.567.5366
1.888.290.6200
fax: 801.650.0423
Membership Director: member@itrain.org

Return to ITrain Homepage

http://itrain.org/itinfo/2000/it000203.html
updated February 3, 2000