[Zope-dev] cgi.py vulnerability = opera multipart handling

[Christian Theune]

--Kj7319i9nmIyA2yE
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

You are right I did not pay that much. Well, I did not thought
of "blaming" really somebody ... just for looking where the
mistake is.

The problem with the Hotfix is following: If one of those
malformed Requests are sent, Zope just raises an Exception
and tells, that there is an invalid boundary thing.
(As you wrote in a previous posting on opera and zope,=20
the newline before the boundary seems to be the reason.)

So Opera is completely unusable and i just want to know
who i should address for that, the opera team for the malformed
request or the Zope Server.

As the next posting tells, it seems to be the Opera, so=20
i will address that to them, to watch out for their=20
multipart form code.


On Thu, Jul 26, 2001 at 09:16:48PM +0200, Dieter Maurer wrote:
> Christian Theune writes:
>  > It seems that my longrunning-unanswered problem with Opera
>  > and Zope (see earlier Posts) is the same as the cgi.py
>  > problem.
>  >=20
>  > My Question: These Requests, that cause the DoS, are they
>  > malformed or valid?
>  >=20
>  > I need to know because if they are malformed, i have to blame=20
>  > the opera team, if they are valid, i have to blame someone
>  > at ZC to fix it otherwise.
> Why do you want to blame someone?
>=20
> Install the "cgi" fix and be happy if your problem disappears.
>=20
> If not, we (mostly you) need to look further to find
> the cause of your problem...
>=20
> Remember, you did not pay 200.000 $ to get Zope....
>=20
>=20
> Dieter

--=20
Christian Theune - ct@gocept.com
gocept gmbh & co.kg - schalaunische strasse 6 - 06366 koethen/anhalt
tel.+49 3496 3099112 - fax.+49 3496 3099118 mob. - 0178 48 33 981

reduce(lambda x,y:x+y,map(lambda x:chr(ord(x)^42),tuple('zS^BED\nX_FOY\x0b'=
)))

--Kj7319i9nmIyA2yE
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: Weitere Infos: siehe http://www.gnupg.org

iD8DBQE7YQjadUt9X/gknwIRAuzDAKDYVGaABgU7/VHqB8Fy6Kt8z6zSrACghpCe
ZzLQezoUUDcT4LrLi30tccU=
=ARoM
-----END PGP SIGNATURE-----

--Kj7319i9nmIyA2yE--