Replacing my black hat with my more typical white hat, one can begin to see how each piece of information that is passed to the user, no matter how innocuous it may appear on its own, can be combined with other data to become a risk to the site's integrity. The 2007 OWASP Top Ten Vulnerabilities document has Information Leakage and Improper Error Handling as the sixth most common Web vulnerability.

While any single, non-confidential piece of configuration data is probably not harmful to be leaked out by itself, in combination with other pieces of configuration data, even the most innocuous piece of data can be used to attack the system. With this in mind, the best strategy is to remove the easiest pieces of configuration data from leaking but not go crazy removing every piece. Odds are that some of the more difficult pieces of configuration data will take so much effort to remove that your efforts are better spent elsewhere.

I want to conclude that before writing the Firefox attack example, I searched both the Citrix website and other security websites and cannot find any vulnerabilities for NetScaler 6.1. That is, if I was actually trying to attack the Firefox site, I probably have run into a dead-end. More importantly, to the best of my knowledge, I have in no way exposed the Firefox website or written anything that exposes the Firefox site in any way. I am strongly in favor of responsible disclosure and almost never believe in exposing a site's vulnerabilities publicly (Bruce Schneier's blog has a nice discussion of the this subject).

Neil Smithline's twenty-year career in software engineering has, for the past eight years, focused almost exclusively on application security in his role as BEA Security Architect. In this position Mr. Smithline co-designed the security framework for WebLogic Server that is now incorporated into most BEA products and becoming part of many Oracle products. During his tenure at BEA, he had the opportunity to interact with hundreds of customers; helping them develop their security architecture, processes, and strategies. He is currently a private application security consultant at his company, OneStopAppSecurity.com.