Bugtraq mailing list archives
Re: Netscape Communicator 4.5 can read local files
From: trev () KICS BC CA (Trev)
Date: Fri, 27 Nov 1998 05:07:36 -0800
After some 2,000 hits on my version of the "Guninski Exploit" in the last couple of days, I have a pretty good idea of what's vulnerable and what's not. If it worked, it would call a specific CGI automatically, however some people did try to call it manually. It appears that the only version of Netscape 4.x that *ISN'T* vulnerable is 4.08 (both windoze and unix). It gives the "security.checkread" error. All other versions faithfully reported back the file contents many times. The funny thing about 4.08 is that it asks the web server for "java/io.class", which doesn't exist. I don't know what the result would be if such a thing did exist. Since it fails due to a security.checkread, I doubt it would make much difference. Trev
Current thread:
- APC PowerNet SNMP Adapter Security Issues - Beta Firmware, (continued)
- APC PowerNet SNMP Adapter Security Issues - Beta Firmware Paul Mansfield (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Pavel Kankovsky (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Terence Christopher Haddock (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Ben Collins (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Terence Christopher Haddock (Nov 25)
- XFree86 3.3.3 Released Aleph One (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Trev (Nov 25)
- Re: Netscape Communicator 4.5 can read local files kpm (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Sven Carstens (Nov 25)
- Re: Netscape Communicator 4.5 can read local files Michael Teichmann (Nov 26)
- Re: Netscape Communicator 4.5 can read local files Trev (Nov 27)
- Java Redirect Bug - Netscpape 4.0[678] and 4.5 Keith Woodard (Nov 27)
- ipfwadm has pseudo-DoS ;) Domas Mituzas (Nov 28)
- Debian: Security flaw in FSP Vanja Hrustic (Nov 28)
- Debian: Security flaw in FSP David Damerell (Nov 30)
- RSI.0010a.11-29-98.IRIX.AUTOFSD RSI Advise (Nov 29)
- Re: Netscape Communicator 4.5 can read local files Todd C. Campbell (Nov 30)