RE: CGI Fact Finding Mission (Need Input)

["Goodbar, Loyd (AFS-Water Valley)" <LGoodbar@xxxxxxxxxxxxxx>]

Why would it not crash your system? (Not flaming, just asking)

I guess it depends on the kind of datachecks that are done on the server
side. In _Hacking Exposed_, the authors address input validation attacks on
web pages. It could be possible to buffer overflow or otherwise compromise
the server CGI program to crash it or gain system access. 

The authors named ASP and generic *NIX (Perl/other CGI) CGI programs. I
don't know if (how) this might affect any server side operations on the
AS/400. The authors (like 99.44% others) ignore the AS/400.

The things I'm proposing looking at for datachecks are:
* Length (not to exceed specified data length)
* Type
* Remove escape characters (*NIX uses "\" as a an escape character, could
cause the CGI program to inadvertently process code or execute a command)
* Bounds checking

This can take time if performed on all input variables, but does go a long
way toward "secure" or "defensive" programming. 

Any thoughts?
Loyd

> -----Original Message-----
> From: Stone, Brad V (TC) [SMTP:bvstone@taylorcorp.com]
> Sent: Friday, 19 November, 1999 10:00 AM
> To:   'MIDRANGE-L@midrange.com'
> Subject:      RE: CGI Fact Finding Mission (Need Input)
> 
> As far as "malicious" data being sent it.  Not worried in the least bit.
> So
> what if a user sends me a bad item number, credit card number, etc.  It's
> not going to crash my system.  Designed properly, I don't see how a hacker
> could cause any problems using query string or standard input data.  If
> you
> have an example, I'd love to hear it.  Maybe there's something I'm
> overlooking.
> 
> Bradley V. Stone
> BVS/Tools
> http://www.bvstools.com
> 
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---