Re: AltaVista_Traversal attack from mod-pubsub.org?

I don't know if ".." is supported in URI, but form data should be okay.
Either one is fine by me, I'm just curious why a request would come back to
the client IP address?

----- Original Message ----- 
From: "Ben Sittler" <[email protected]>
To: "S. Mike Dierken" <[email protected]>; "Adam Rifkin" <[email protected]>
Cc: <[email protected]>
Sent: Sunday, October 05, 2003 4:43 PM
Subject: RE: [Mod-pubsub-developer] AltaVista_Traversal attack from
mod-pubsub.org?


Apparently this means we sometimes submit form data with "../" in it. I
regard this as correct behavior (we don't use that to circumvent security,)
and see no reason to change our data format to work around this particularly
harmful firewall heuristic. Your thoughts?

-Ben

-----Original Message-----
From: [email protected] on behalf of S. Mike
Dierken
Sent: Sat 10/4/2003 9:20 PM
To: Adam Rifkin
Cc: [email protected]
Subject: [Mod-pubsub-developer] AltaVista_Traversal attack from
mod-pubsub.org?
I'm seeing Norton Internet Firewall detect an attack sourced at
mod-pubsub.org whenever I connect to the chat server there. It claims an
attack similar to the AltaVista_Traversal is ocurring. Different incoming
ports are reported.

Does anybody know what this means?



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Mod-pubsub-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-pubsub-developer





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf