Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
From: "Hagan, Mark " <haganm@citi.com.INVALID>
To: "'users@httpd.apache.org'" <users@httpd.apache.org>
Thread-Topic: XSS Issue in v2.0.59
Thread-Index: AdLC833XO/wnZTprSZCmDhM+FgQbIw==
Date: Tue, 2 May 2017 03:24:01 +0000
Message-ID: <4DCD416180243D458C6FF3893DD8194B99BE26AC@EXGTMB46.nam.nsroot.net>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_4DCD416180243D458C6FF3893DD8194B99BE26ACEXGTMB46namnsro_"
MIME-Version: 1.0
Subject: [users@httpd] XSS Issue in v2.0.59
archived-at: Tue, 02 May 2017 03:24:31 -0000

--_000_4DCD416180243D458C6FF3893DD8194B99BE26ACEXGTMB46namnsro_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hello All,

Looking for some help to determine if I can configure Apache 2.0.59 to addr=
ess a couple Cross Site Scripting (XSS) vulnerabilities. I'm not able to up=
grade to a later version, so I'm trying to understand if there is functiona=
lity within this version to address the XSS issue.


I have 2 specific issues:

1. Validating input (whitelisting acceptable characters)

2. Sanitizing or encoding output (For instance, the character < would be en=
coded as &lt; which would be displayed by the browser as the "less-than" ch=
aracter instead of being interpreted as the start
of an HTML tag.)


I am not an experienced apache administrator, so any help would be most app=
reciated.


Thanks.


--_000_4DCD416180243D458C6FF3893DD8194B99BE26ACEXGTMB46namnsro_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Verdana;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
span.postbody1
	{mso-style-name:postbody1;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span class=3D"postbody1"><span style=3D"font-size:8=
.5pt;font-family:&quot;Verdana&quot;,&quot;sans-serif&quot;;color:#333333">=
Hello All,
</span></span><span style=3D"font-size:8.5pt;font-family:&quot;Verdana&quot=
;,&quot;sans-serif&quot;;color:#333333"><br>
<br>
<span class=3D"postbody1">Looking for some help to determine if I can confi=
gure Apache 2.0.59 to address a couple Cross Site Scripting (XSS) vulnerabi=
lities. I'm not able to upgrade to a later version, so I'm trying to unders=
tand if there is functionality within
 this version to address the XSS issue. </span><br>
<br>
<br>
<span class=3D"postbody1">I have 2 specific issues: </span><br>
<br>
<span class=3D"postbody1">1. Validating input (whitelisting acceptable char=
acters) </span>
<br>
<br>
<span class=3D"postbody1">2. Sanitizing or encoding output (For instance, t=
he character &lt; would be encoded as &amp;lt; which would be displayed by =
the browser as the &#8220;less-than&#8221; character instead of being inter=
preted as the start
</span><br>
<span class=3D"postbody1">of an HTML tag.) </span><br>
<br>
<br>
<span class=3D"postbody1">I am not an experienced apache administrator, so =
any help would be most appreciated.<o:p></o:p></span></span></p>
<p class=3D"MsoNormal"><span class=3D"postbody1"><span style=3D"font-size:8=
.5pt;font-family:&quot;Verdana&quot;,&quot;sans-serif&quot;;color:#333333">=
<o:p>&nbsp;</o:p></span></span></p>
<p class=3D"MsoNormal"><span class=3D"postbody1"><span style=3D"font-size:8=
.5pt;font-family:&quot;Verdana&quot;,&quot;sans-serif&quot;;color:#333333">=
<o:p>&nbsp;</o:p></span></span></p>
<p class=3D"MsoNormal"><span class=3D"postbody1"><span style=3D"font-size:8=
.5pt;font-family:&quot;Verdana&quot;,&quot;sans-serif&quot;;color:#333333">=
Thanks.<o:p></o:p></span></span></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>

--_000_4DCD416180243D458C6FF3893DD8194B99BE26ACEXGTMB46namnsro_--