Re: [nv-l] cross-site scripting exposure
2003-11-22 11:27:50
If you are not using the Netview web client, then don't start the webserver daemon. Wouldn't that close port 8080?
Cordially,
Leslie A. Clark
IBM Global Services - Systems Mgmt & Networking
Detroit
| "Chris Coulson" <ccoulson AT ca.ibm DOT com>
Sent by: owner-nv-l AT lists.us.ibm DOT com
11/20/2003 02:55 PM
Please respond to nv-l
|
To: nv-l AT lists.tivoli DOT com
cc:
Subject: [nv-l] cross-site scripting exposure
|
I have NetView V7.1.3 on AIX 5.1. I was just informed by my AIX Server
support people that a security scan has just identified the following
exposure:
[HTTP/8080/TCP] Server is an enabling vector for cross-site scripting
exposure in clients [trace-1]
Currently, we 3 http servers on this device:
1. For the TREND Application - on port 80 (defaults to port 80)
2. IBM HTTP server on port 85 - but it is down right now. It was taken
down.
3. NetView on port 8080
CERT says there is no fix for the exposure, but the server can disable
scripting. I don't know if scripting enabled or disabled will affect
NetView.
Has anyone been flagged with this exposure?
We never use the Web Server function to access NetView. Is there a way to
correct this security exposure?
Thanks,
Chris Coulson
ccoulson AT ca.ibm DOT com
|
|
|