Reply from the developer of JWIG regarding "Hack Annotations in JWIG" by secniche.org
Hi Pranay (cc to "SecNiche"),
Thank you for bringing this to our attention. I have now read this document "Hack Annotations in JWIG", and I must admit that I have never seen so
much bogus in so few pages ever before. Is this a (bad) joke?? It seems that the author Aditya K Sood (a.k.a. Bubba Gump?) has completely
misunderstood the processing model of web communication in general and JWIG in particular. JWIG is a research project exploring new ways of
programming web applications. JWIG programs run on the server, and the JWIG system obviously does not by itself provide any means for attackers to
control which code is being executed on the server. This means that all the example "attacks" described in this report seem to assume that the
attacker is the service programmer, which clearly doesn't make much sense.
I hope that anyone reading a report like "Hack Annotations in JWIG" quickly will see that it is all bogus. However, I would naturally prefer that
"SecNiche" would withdraw these absurd claims whereever they have been published.
Regards,
Anders
Pranay Kanwar wrote:
> Hello,
>
>
> I would like to bring to your notice the following claims regarding the bogus
> security problems in JWIG.
>
>
> http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064768.html
> http://www.securityfocus.com/archive/1/474156/30/0/threaded
> http://www.webappsec.org/lists/websecurity/archive/2007-07/msg00022.html
> http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf
>
> Kindly comment on these, I would request this as this makes wrong assumptions
> and will hinder the usage of JWIG technology.
>
> I have also negated the claims myself.
>
> Regards
>
> warl0ck // MSG
--
Anders Moeller
amoeller_at_brics.dk
http://www.brics.dk/~amoeller
Hence kindly do not entertain any more bogus from secniche, also i don't understand what in the
world are the CVE maintainers doing.
warl0ck // MSG
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Jul 22 2007
Intro
