issue with custom 404 page creating false-positives during security scan

[ol jeb]

hey all,

my web guys created a custom 404 page for a client and it works just fine. i am having issues though, when i run my security scanner on the site, i get a lot of false-positives(58 to be exact). if i remove the custom error page and replace it with the original, these false exploits do not show up. the custom 404 page is just static html, nothing to fancy, so i'm not sure if it's their code or my scanner??? i did try adding a 404 string in the custom 404 page, but the scanner still got the same false-positives.

i am trying to get this custom 404 page to not show these false-positives, so if anyone could shed some light on this for me i would appreciate it.


btw
web server used: iis 5.0
security scanner used: http://www.gfi.com/lannetscan/index.htm

[DjM]

What does your Scanner think it's finding? Does it give you any indication as to what is wrong with the page? Can you post an attachment of what your Scanner is reporting?

Cheers:

[ol jeb]

well, it thinks that it is finding a bunch of cgi abuses. it shows exploits for stuff that we are not even using, stuff like cold fusion, which we have never used. like i mentioned, if i place the default 404 page back where it is supposed to be and remove the custom 404 page, none of these exploits show up. which makes me think that my web guys either don't want to fix it or don't know how. course i may be wrong???

1 - informational item found
58 - cgi abuses found

i'm attaching a sterilized scan report:

[DjM]

Well, that's just plain strange. I think I am going to have to defer to some of the Web Techies. here. I don't know if you can (or will), but posting a copy of the source (sterilized of course) for the custom page may help the Web people debug your problem.

Cheers: