Subject: Re: [xsl] insecure xslt From: Robert Koberg <rob@xxxxxxxxxx> Date: Thu, 24 Nov 2005 09:09:16 -0500 |
http://metasploit.com/research/vulns/google_proxystylesheet/
A security hole in the google search appliance is xslt based, basically from what I've seen of the appliance this is something that an administrator should be able to fix themselves. But if one can't go through all the configuration possibilities there is a patch.
I was not aware that the stylesheet engine was oracle based as is indicated here though, one of the things that I had assumed from talks with google support was that theirs was not a complete xslt 1.0 implementation - based on my asking for document function support and being told that it supported all the functions that it needed to do its job - which sounded like a no to me.
best, -Rob
Current Thread |
---|
|
<- Previous | Index | Next -> |
---|---|---|
[xsl] insecure xslt, bryan rasmussen | Thread | Re: [xsl] insecure xslt, bryan rasmussen |
Re: [xsl] Sorting Index alphabetica, Ragulf Pickaxe | Date | Re: [xsl] insecure xslt, bryan rasmussen |
Month |