[15767] in bugtraq
Netscape SmartDownload reports file information to AOL
daemon@ATHENA.MIT.EDU (John L. Morello)
Thu Jul 13 19:04:53 2000
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
micalg=SHA1; boundary="----=_NextPart_000_00BF_01BFEC04.EC9A6930"
Message-Id: <00c401bfec2e$d7f0b370$70140b18@johnathome>
Date: Wed, 12 Jul 2000 13:27:28 -0500
Reply-To: "John L. Morello" <jmorel2@LSU.EDU>
From: "John L. Morello" <jmorel2@LSU.EDU>
To: BUGTRAQ@SECURITYFOCUS.COM
This is a multi-part message in MIME format.
------=_NextPart_000_00BF_01BFEC04.EC9A6930
Content-Type: multipart/mixed;
boundary="----=_NextPart_001_00C0_01BFEC04.EC9A6930"
------=_NextPart_001_00C0_01BFEC04.EC9A6930
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
According to a story on The Register, and confirmed by examining my own
cookies, Netscape Communicator's SmartDownload component records the files
it downloads, the client IP, the server IP, and the time, then forwards this
information to AOL without informing the user. In other words, AOL receives
a download-by-download report of each file Communicator downloads, its file
name, your IP, and the server it came from. This information is passed on
to AOL without user interaction or notification. Additionally,
the information is recorded locally in a cookie file. When combined with
other exploits which allow for remote transfer of cookie files, this
vulnerability could reveal detailed information on a user's browsing
habits. For more information, see the story at
http://www.theregister.co.uk/content/1/11895.html
____________________________
::: John L. Morello :::
LSU Office of Computing Services
------=_NextPart_001_00C0_01BFEC04.EC9A6930
Content-Type: text/x-vcard;
name="John L. Morello.vcf"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="John L. Morello.vcf"
BEGIN:VCARD
VERSION:2.1
N:Morello;John;L.
FN:John L. Morello
ORG:LSU Office of Computing Services;Technology Support Center
TITLE:Student Analyst
TEL;WORK;VOICE:225.578.1309
TEL;HOME;VOICE:225.761.1306
TEL;CELL;VOICE:225.802.3078
TEL;PAGER;VOICE:225.929.4630
TEL;WORK;FAX:225.388.6400
ADR;WORK;ENCODING=3DQUOTED-PRINTABLE:;Room 215;Frey Computing Services =
Center=3D0D=3D0ALouisiana State University;Bat=3D
on Rouge;LA;70803;USA
LABEL;WORK;ENCODING=3DQUOTED-PRINTABLE:Room 215=3D0D=3D0AFrey Computing =
Services Center=3D0D=3D0ALouisiana State University=3D
=3D0D=3D0ABaton Rouge, LA 70803=3D0D=3D0AUSA
ADR;HOME:;;4600 Burbank #232;Baton Rouge;LA;70820;USA
LABEL;HOME;ENCODING=3DQUOTED-PRINTABLE:4600 Burbank #232=3D0D=3D0ABaton =
Rouge, LA 70820=3D0D=3D0AUSA
URL:http://www.johnmorello.com
URL:http://www.john.ocs.lsu.edu
EMAIL;INTERNET:johnlmorello@hotmail.com
EMAIL;PREF;INTERNET:john@johnmorello.com
EMAIL;INTERNET:jmorel2@lsu.edu
REV:20000712T182728Z
END:VCARD
------=_NextPart_001_00C0_01BFEC04.EC9A6930--
------=_NextPart_000_00BF_01BFEC04.EC9A6930
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIII6DCCApsw
ggIEoAMCAQICAwLgeTANBgkqhkiG9w0BAQQFADCBlDELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdl
c3Rlcm4gQ2FwZTEUMBIGA1UEBxMLRHVyYmFudmlsbGUxDzANBgNVBAoTBlRoYXd0ZTEdMBsGA1UE
CxMUQ2VydGlmaWNhdGUgU2VydmljZXMxKDAmBgNVBAMTH1BlcnNvbmFsIEZyZWVtYWlsIFJTQSAx
OTk5LjkuMTYwHhcNMDAwNzEwMDM0MTI2WhcNMDEwNzEwMDM0MTI2WjBBMR8wHQYDVQQDExZUaGF3
dGUgRnJlZW1haWwgTWVtYmVyMR4wHAYJKoZIhvcNAQkBFg9qbW9yZWwyQGxzdS5lZHUwgZ8wDQYJ
KoZIhvcNAQEBBQADgY0AMIGJAoGBALhzhFKBPt8WZiZpBDv4yGOAQ14OVnjOJMZca33T1lXbzUUZ
wLBKbVdjT64goiwSQa4MD45eoEhaKHcPzXbKNuvgqkjWkMhIiru7QhOM6wKBMRu1wNDftrTGtwc1
9YUFGSuUWDlrD147mWclA0W86zM9OGRXNLnfDvwNSGTrknEbAgMBAAGjTTBLMBoGA1UdEQQTMBGB
D2ptb3JlbDJAbHN1LmVkdTAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFIir8WCDZlX05FjHRh3A
Yb0j18OMMA0GCSqGSIb3DQEBBAUAA4GBADUicDlukBaVRRJljP5d6vSCmXgQ2xP01L7+IDqBrEPS
0si3jH5OO2M462qVnZR9QVPSYZnhbBDP/OBeHUgGHSJ57kQDX+loofBXvuwzKQjuKqunR1zWwUJ7
q5h/K0zmfjrqcFyaLLnPZ6mqB+vzWnGY2F3Pai2HzH37TqqCdgddMIIDFDCCAn2gAwIBAgIBCzAN
BgkqhkiG9w0BAQQFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAG
A1UEBxMJQ2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2Vy
dGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZy
ZWVtYWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4X
DTk5MDkxNjE0MDE0MFoXDTAxMDkxNTE0MDE0MFowgZQxCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxX
ZXN0ZXJuIENhcGUxFDASBgNVBAcTC0R1cmJhbnZpbGxlMQ8wDQYDVQQKEwZUaGF3dGUxHTAbBgNV
BAsTFENlcnRpZmljYXRlIFNlcnZpY2VzMSgwJgYDVQQDEx9QZXJzb25hbCBGcmVlbWFpbCBSU0Eg
MTk5OS45LjE2MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzaVqX1NAWC3q1xV3pIZwjcs0S
TEv3fs/H+8pyJPRCUqxXleN7YXoXhOf9cjk4lLTq7WWnkgZeveBl9hm7lHl2TD65aHB1hBz0EXQA
vAUsTwkDFzHM9EHUcsamXeKIRLCLLsRN8fDWhT5s85WUeJF+QOmc0Y0VV47Cc+Uw3kb1TwIDAQAB
ozcwNTASBgNVHRMBAf8ECDAGAQH/AgEAMB8GA1UdIwQYMBaAFHJJwnM0xlX0C3ZygX539IfnxrIO
MA0GCSqGSIb3DQEBBAUAA4GBAGvGWekx+um27LED2N9ycv6RYEjqxlXde/BnjsZhcOdtwqU32J23
FyhWBYvdXHVvxpGQxmxmcRPQEHxrkW+G4CE2LcHX6rIJrc8tbcaDUpv7u/6ch538t+l0kuRcl678
fqzKDW9yemcsa3P1hvmd9QBu9B0Hzp2egmMp75MJflXeMIIDLTCCApagAwIBAgIBADANBgkqhkiG
9w0BAQQFADCB0TELMAkGA1UEBhMCWkExFTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJ
Q2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNh
dGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWls
IENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTk2MDEw
MTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJu
IENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAm
BgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhh
d3RlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1GnX1LCUZFtx6UfYDFG26nKRsIRe
fS0Nj3sS34UldSh0OkIsYyeflXtL734Zhx2G6qPduc6WZBrCFG5ErHzmj+hND3EfQDimAKOHePb5
lIZererAXnbr2RSjXW56fAylS1V/Bhkpf56aJtVquzgkCGqYx7Hao5iR/Xnb5VrEHLkCAwEAAaMT
MBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQQFAAOBgQDH7JJ+Tvj1lqVnYiqk8E0RYNBv
jWBYYawmu1I1XAjPMPuoSpaKH2JCI4wXD/S6ZJwXrEcp352YXtJsYHFcoqzceePnbgBHH7UNKOgC
neSa/RP0ptl8sfjcXyMmCZGAc9AUG95DqYMl8uacLxXK/qarigd1iwzdUYRr5PjRzneigTGCAgAw
ggH8AgEBMIGcMIGUMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRQwEgYDVQQH
EwtEdXJiYW52aWxsZTEPMA0GA1UEChMGVGhhd3RlMR0wGwYDVQQLExRDZXJ0aWZpY2F0ZSBTZXJ2
aWNlczEoMCYGA1UEAxMfUGVyc29uYWwgRnJlZW1haWwgUlNBIDE5OTkuOS4xNgIDAuB5MAkGBSsO
AwIaBQCggbowGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDAwNzEy
MTgyNzI4WjAjBgkqhkiG9w0BCQQxFgQUuoF18YTUsqWQ1DIzA2vE/h+psQcwWwYJKoZIhvcNAQkP
MU4wTDAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcw
DQYIKoZIhvcNAwICASgwBwYFKw4DAh0wDQYJKoZIhvcNAQEBBQAEgYCJny8ldJb206v3RtN+WrzU
vOJU4qXLoOeS4iuxAimyRMT37AUMspkDArru3oHgi5DWNtyJII8ImNGew+zrlcbMH3NHOUDCQPBG
MYl61G8/m2vA8a2HY5lw+XUMjOwYFBJvTDDBxu1/tDt+TaXDVmVt+axxjCCanUBkpLuJ5WGMogAA
AAAAAA==
------=_NextPart_000_00BF_01BFEC04.EC9A6930--
