Bugtraq: RE: Bypassing of web filters by using ASCII

["James C. Slora Jr." <james.slora () phra com>]

Hubert Seiwert wrote Monday, June 26, 2006 1:57 PM

> I don't currently see how this "ascii vulnerability" would make code 
> injection possible on webservers where the Content-Type is not 
> US-ASCII already, as the 3 methods mentioned to change the charset 
> (http-equiv content-type header, CSS @charset, document.charset) 
> depend on being able to inject things already.
Agreed - the ASCII vulnerability doesn't make servers less secure. It
doesn't make user-agents less secure either, since nothing here has
exposed any new attack vectors. It merely introduces a big, glaring,
open way for hostile code to evade detection when delivered from hostile
servers or in served code that is already vulnerable to injection. Doing
this without XSS can further exploit site trust.

So while the merits of IE's US-ASCII rendering choice can be easily
debated, products that claim to help protect IE users by detecting
hostile code need to step up and cover the ASCII issue fully.

- Jim