('binary' encoding is not supported, stored as-is)
>Maybe it _calls_ server side code (by hitting
> urls or other channel), but it doesn't run
>there.
>Maybe they want you to put "controls" on that code?
If that really is what they mean, what controls can be put in place to mitigate the risk? I can think of input filtering and validation on server side code to defend against buffer overflow. Any other measure besides this?
I don't understand what they mean by "environment attacks". Any one can share some thought on this? Thanks.
-------------------------------------------------------------------------
This List Sponsored by: Watchfire
Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. See for yourself.
Download AppScan 6.0 today.
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------
Received on Jan 12 2006
Intro
