BUGTRAQ: Netscape Communicator bookmarks <TITLE> security vulnerability May 24, 1999, 20 :23 UTC (3 Talkback[s]) (5319 reads)
There is a security bug in Netscape Communicator 4.51 Win95, 4.07 Linux
(guess all 4.x versions are affected) in the way they handle special
bookmarks with JavaScript code in the title.
If you enclose a JavaScript code with <SCRIPT> tags in the
<TITLE> tag and
bookmark that page, the JavaScript code is written in the local bookmarks
file. Then when the bookmarks file is open, the JavaScript code is
executed in the security context of a local file - the bookmarks file. The
bookmarks file may be open by a script, probably a server redirect or by
the user. The bookmarks file name must be known, but it is easily guessed
for most dialup users.
Vulnerabilities: reading user's bookmarks, browsing local directories,
reading local files (works fine on Linux, probably possible on Windows).
Workaround: Disable JavaScript or do not bookmark untrusted pages.
