WebApp Sec mailing list archives
Convenience or just bad design?
From: "Saqib Ali" <docbook.xml () gmail com>
Date: Tue, 11 Jul 2006 19:30:46 -0700
So Altiris.com website allows their customers to upload files to their servers. The filenames are based on the email address of the customer. The interesting part is that they make this upload directory web accessible by FTP. So now not only you can access all the uploaded files, you can also get the email addresses of the Altiris customers. Some of the file are very interesting. They include actual unreleased applications. ftp://wise1:w1s3ftp@209.104.132.121/wisesol/www/bugs/ Doesn't this go against their privacy policy? http://www.altiris.com/company/legal/privacy.aspx When will companies realize the importance of good secure design???? -- Saqib Ali, CISSP, ISSAP Support http://www.full-disc-encryption.com ------------------------------------------------------------------------- Sponsored by: WatchfireCross-Site Scripting (XSS) is one of the most common application-level attacks that hackers use to sneak into web applications today. This whitepaper will discuss how traditional CSS attacks are performed, how to secure your site against these attacks and check if your site is protected. Cross-Site Scripting Explained - Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr --------------------------------------------------------------------------
Current thread:
- Convenience or just bad design? Saqib Ali (Jul 12)
- RE: Convenience or just bad design? Robert D. Holtz (Jul 12)