XSS flaws found in sites of multiple anti-virus firms Security researchers have revealed that the websites of no less than six anti-virus firms are vulnerable to cross-site scripting flaws, of a type that might lend themselves to phishing attacks. Some of the firms involved have admitted problems, while others say the issues raised have either already been fixed or are erroneous …
It seems every time I'm asked to "fix" an infected PC (Vista or XP) it usually has McAfee installed. Of course Comcast is "giving" it to all their high speed internet customers. I just tell the client that their software is worth just what they paid for it.
And the Symantec corporate AV that I use has decided that Reflexive Arcade games are all trojans and need to be quarantined. Ah well, back to the drawing boards...
It is a browser vulnerability and not web server vulnerability that we see here.
yes, ok...if a website filters user input..etc., xss attacks are REDUCED, but will never go away
on the other hand, if you DISABLE javascript and iframes on your WEB BROWSER, then XSS, PHISHING attacks are not just reduced, but something you DO NOT HAVE TO WORRY ABOUT. As in, you won't be a victim of xss or phishing attacks.
In Summary, it is browser vulnerability and people seem to think that it is a web server vulnerability.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
