Re: Editing your ISP Account Details

[Steve Mosher <goat () PHOENIX ISN NET>]

On Thu, 26 Oct 2000, Ankit Fadia wrote:
> I don't know whether this has come up earlier or not. But recently, I
> discovered a security loophole exisiting in Netscape Enterprise (Atleast,
> haven't tested on other OS's.) which allows any person having an account on
> that server to edit account details like Contact Information etc, even if
> the sysadmin does not want normal users to do so.
<snip>

        This would only affect Netscape Enterprise, AFAIK, since other
webservers wouldn't have any reason to follow Netscape's model. What's
more, just because a company uses Netscape Enterprise doesn't mean they
use that to manage their users, so any user information contained within
might be irrelevent. OTOH, if a company does use Netscape Enterprise to
manage their user accounts and it behaves the way you describe, then this
is a very real issue.

--
Steve