From: Progeny Security Team <security@progeny.com> Subject: PROGENY-SA-2001-07: Netscape Navigator fails to protect privacy Date: Thu, 19 Apr 2001 19:26:36 -0500 (EST)
PROGENY LINUX SYSTEMS -- SECURITY ADVISORY PROGENY-SA-2001-07 Topic: Netscape Navigator fails to protect privacy Software: netscape Announced: 2001-04-09 Credits: Florian Wesch <fw@dividuum.de> Affects: Progeny Debian (netscape prior to 4.77) Debian GNU/Linux (netscape prior to 4.77) Vendor-Status: New Version Released (4.77 on 2001-03-26) Corrected: 2001-04-19
Progeny Only: NO $Id: PROGENY-SA-2001-07,v 1.2 2001/04/20 00:21:42 jdaily Exp $
SYNOPSIS
The Netscape browser sometimes handles JavaScript in an insecure
manner. In certain situations, it allows remote web sites to send
JavaScript commands in an unorthodox manner that could compromise
private data.
PROBLEM DESCRIPTION
GIF-format graphics can contain comments, typically used by
graphic designers and editors for recordkeeping. Florian Wesch
discovered that the Netscape browser, while displaying a GIF image,
can process JavaScript commands stored in GIF comments, and that
commands issued in this unorthodox manner can do things that
JavaScript commands are usually unable to do.
IMPACT
A web site can gain access to browser history and possibly other
data kept in Netscape’s browser that wouldn’t normally be
available.
SOLUTION
Upgrade to a fixed version of Netscape’s browser. Netscape
Navigator version 4.77 corrects the problem. For your convenience,
you may upgrade to the package netscape_4.77-1progeny2.
WORKAROUND
The risk can be avoided without an upgrade by disabling
JavaScript in the browser.
UPDATING VIA APT-GET
1. Ensure that your /etc/apt/sources.list file has a URI for
Progeny’s update repository:
deb http://archive.progeny.com/progeny updates/newton/
2. Update your cache of available packages for apt(8).
Example:
# apt-get update
3. If you are currently running the Netscape browser, please
exit the
application.
4. Using apt(8), install the new package. apt(8) will download
the
update, verify its integrity with md5, and then install the
package on your system with dpkg(8).
Example:
# apt-get install netscape
UPDATING VIA DPKG
We do not recommend upgrading Netscape’s browser using dpkg.
Please use apt.
MORE INFORMATION
See http://www.securityfocus.com/archive/1/175060
for further details of the vulnerability.
Progeny advisories can be found at http://www.progeny.com/security/.
pub 1024D/F92D4D1F 2001-04-04 Progeny Security Team <security@progeny.com>