Re: Global *.net XSS, thank you Verisign(TM)

["morning_wood" <se_cur_ity () hotmail com>]

have you never heard of a untrusted link??? obviously not.. hint: GET A CLUE

Donnie Werner
http://e2-labs.com 
http://exploitlabs.com 

> And how is this a security issue that is of anything more than trivial
> importance?  How is it a "global XSS" hole?
>
> The hole is on a page on sitefinder.verisign.com, not on the server that
> is answering for *.net and *.com.  All that server does is redirect you.
> The impact of the hole is the same regardless of if the *.com and *.net
> wildcard exists or not.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html