Re: [CVE 2007-3816] [Advisory] Vulnerability Facts Related JWIG Advisory

[Pranay Kanwar <warl0ck () metaeye org>]

Reply from the developer of JWIG regarding "Hack Annotations in JWIG" by secniche.org


Hi Pranay (cc to "SecNiche"),

Thank you for bringing this to our attention. I have now read this document "Hack Annotations in JWIG", and I must 
admit that I have never seen so
much bogus in so few pages ever before. Is this a (bad) joke?? It seems that the author Aditya K Sood (a.k.a. Bubba 
Gump?) has completely
misunderstood the processing model of web communication in general and JWIG in particular. JWIG is a research project 
exploring new ways of
programming web applications. JWIG programs run on the server, and the JWIG system obviously does not by itself provide 
any means for attackers to
control which code is being executed on the server. This means that all the example "attacks" described in this report 
seem to assume that the
attacker is the service programmer, which clearly doesn't make much sense.
I hope that anyone reading a report like "Hack Annotations in JWIG" quickly will see that it is all bogus. However, I 
would naturally prefer that
"SecNiche" would withdraw these absurd claims whereever they have been published.

Regards,
Anders


Pranay Kanwar wrote:
> Hello,
>
>
> I would like to bring to your notice the following claims regarding the bogus
> security problems in JWIG.
>
>
> http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064768.html
> http://www.securityfocus.com/archive/1/474156/30/0/threaded
> http://www.webappsec.org/lists/websecurity/archive/2007-07/msg00022.html
> http://www.secniche.org/papers/HackAnnotationsInJWIG.pdf
>
> Kindly comment on these, I would request this as this makes wrong assumptions
> and will hinder the usage of JWIG technology.
>
> I have also negated the claims myself.
>
> Regards
>
> warl0ck // MSG


-- 
Anders Moeller
amoeller () brics dk
http://www.brics.dk/~amoeller

Hence kindly do not entertain any more bogus from secniche, also i don't understand what in the
world are the CVE maintainers doing.


warl0ck // MSG

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/