Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Re: Re: Apache Server HTML Injection and UTF-7 XSS Vulnerability
From: Tom.Donovan () acm org
Date: 14 May 2008 17:20:52 -0000

Setting the HTTP response header:
 Content-Type: text/html; charset=iso-8859-1

or adding the tag:
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">

or even both - still does not deter IE from scanning the contents and interpreting them as UTF-7 when 
Encoding=Auto-Select.
(observed on w2k with IE 6.0.2800.1106 SP1 + Q867801 + Q823353 + Q833989 + Q903235)

It appears there is little that web servers can do to thwart this, short of changing all '+' characters to %2B.  That 
seems excessive.

-tom-


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]