|
 |
|
There is a security bug in Netscape Communicator 4.51 Win95, 4.07 Linux (guess all 4.x versions are affected) in the way they handle special bookmarks with JavaScript code in the title. If you enclose a JavaScript code with <SCRIPT> tags in the <TITLE> tag and bookmark that page, the JavaScript code is written in the local bookmarks file. Then when the bookmarks file is open, the JavaScript code is executed in the security context of a local file - the bookmarks file. The bookmarks file may be open by a script, probably a server redirect or by the user. The bookmarks file name must be known, but it is easily guessed for most dialup users. Vulnerabilities: reading user's bookmarks, browsing local directories, reading local files (works fine on Linux, probably possible on Windows). Workaround: Disable JavaScript or do not bookmark untrusted pages. Demonstration is available at: http://www.nat.bg/~joro/book2.html See attached file for the source. Georgi Guninski http://www.nat.bg/~joro http://www.whitehats.com/guninsk  
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
|
|
|
|
| All times are recorded in UTC. Linux is a trademark of Linus Torvalds. Powered by Linux, Apache and PHP 
Legal Notices, Licensing, Reprints, Permissions, Privacy Policy.
Whitepapers and eBooks
|
