Linux Today: Linux News On Internet Time.
Search Linux Today
search.internet.com
Linux News Sections:  Blog -  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Preferences
Contribute
Link to Us
Search
Linux Jobs

internet.commerce
Be a Commerce Partner

GPS
Prepaid Phone Card
Memory
Computer Deals
Promos and Premiums
KVM over IP
Shop Online
Laptops
Online Universities
Promotional Pens
Televisions
Desktop Computers
Find Software
Imprinted Promotions

The Linux Channel at internet.com
Linux Today
Enterprise Linux Today
Apache Today
JustLinux.com
Linux Planet
PHPBuilder
All Linux Devices
Technology Jobs

JustTechJobs.com

LinuxToday Newsletters
Subscribe News
Subscribe PR
Subscribe Security

internet.com
IT
Developer
Internet News
Small Business
Personal Technology
International

Search internet.com
Advertise
Corporate Info
Newsletters
Tech Jobs
E-mail Offers

 
Featured Solutions for Technology Professionals from Internet.com
Whitepaper: Storage Management Costs in the Enterprise
Sponsored by HP
This report should be read by anyone responsible for choosing storage solutions for their organizations or for making administrative personnel decisions in the data center. Many factors contribute to the ownership cost for enterprise storage. Get the comparison of Mid-Range Array Solutions here. Learn more.

Are Your Threads Being Served Efficiently?
Sponsored by AMD
Find out what your threads are up to on the cores inside your CPU with AMD CodeAnalyst Performance Analyzer. With CodeAnalyst's thread profiling you can instantly see the thread chart and non-local memory access to determine if your threads are being served as efficiently as possible. Get CodeAnalyst now! Click here.
Learn more at AMD Developer Central.

View the Instruction Pipeline with AMD CodeAnalystTM Performance Analyzer
Sponsored by AMD
With AMD's Instruction Based Sampling technology, it's easy for you to see how your program instructions are being executed through the processor pipeline. With CodeAnalyst Performance Analyzer you'll know right away whether your code is moving through the pipeline or stalling it out. Learn more. Click here.
Learn more at AMD Developer Central.

Current Newswire:

Defending Openness in the European Union

Sourceforge Community Choice Finalists: Some Curious Choices

KDE Developer Quits

A User's Freedom to Choose

Microsoft Rebuilds Open Source Sandcastle

In Note To Judge, Hans Reiser Asks For New Lawyer

Michael Robertson, Where's the Cash?

Identi.ca Launches, an Open Source Twitter

Guinness Bestows Download Record on Firefox

Barracuda Networks Countersues Trend Micro

Systems Administrator
Care.com
US-MA-Waltham

Justtechjobs.com Post A Job | Post A Resume
:BUGTRAQ: Netscape Communicator bookmarks <TITLE> security vulnerability
BUGTRAQ: Netscape Communicator bookmarks <TITLE> security vulnerability
May 24, 1999, 20 :23 UTC (3 Talkback[s]) (4408 reads)

There is a security bug in Netscape Communicator 4.51 Win95, 4.07 Linux (guess all 4.x versions are affected) in the way they handle special bookmarks with JavaScript code in the title.

If you enclose a JavaScript code with <SCRIPT> tags in the <TITLE> tag and bookmark that page, the JavaScript code is written in the local bookmarks file. Then when the bookmarks file is open, the JavaScript code is executed in the security context of a local file - the bookmarks file. The bookmarks file may be open by a script, probably a server redirect or by the user. The bookmarks file name must be known, but it is easily guessed for most dialup users.

Vulnerabilities: reading user's bookmarks, browsing local directories, reading local files (works fine on Linux, probably possible on Windows).

Workaround: Disable JavaScript or do not bookmark untrusted pages.

Demonstration is available at: http://www.nat.bg/~joro/book2.html See attached file for the source.

Georgi Guninski
 http://www.nat.bg/~joro
 http://www.whitehats.com/guninsk

Index Mode   |   Flat Mode   |   Thread Mode   |   Thread Flat  
  Talkback(s) Name  and Date
that&#39;s what you get with bloatware.  ...   that's what you get with bloatware.   
ac
May 24, 1999, 20:48:50
 
... to turn OFF JavaScript, seems every  ...   Thanks for the reminder...   
Debora Weber-Wulff
May 26, 1999, 04:56:14
 
That&#39;s why I use IE for untrusted si ...   Internet Exploder   
Balazs Barany
May 26, 1999, 07:21:19
 
  Home | Search Talkbacks | Customize View    Top of Page  



Enter your comments below:

* Your Name:

* Your Email Address:

* Subject:

CC: [will also send this talkback to an E-Mail address]

* Comments:

Tags allowed:<I>,<B> and <U>. See our talkback-policy for more about talkback content.

Fields marked with * are required!


OBA and UC: Directions for Developers
Intel Whitepaper: Wireless Technologies and e-Learning--Bridging the Digital Divide
Intel Whitepaper: Improve Security and Control of Your PCs
Tutorial: Create Secure Java Applications Productively
Access the RIA Development Center & get the latest news, insights, tips & resources now

..............................


All times are recorded in UTC.
Linux is a trademark of Linus Torvalds.
Powered by Linux, Apache and PHP

JupiterOnlineMedia

internet.comearthweb.comDevx.commediabistro.comGraphics.com

Search:

Jupitermedia Corporation has two divisions: Jupiterimages and JupiterOnlineMedia

Jupitermedia Corporate Info


Legal Notices, Licensing, Reprints, & Permissions, Privacy Policy.

Advertise | Newsletters | Tech Jobs | Shopping | E-mail Offers

Solutions
Whitepapers and eBooks
IBM eBook: Planning a Service Oriented Architecture
IBM eBook: Choosing the Right Architecture--What It Means for You and Your Business
Microsoft Article: Will Hyper-V Make VMware This Decade's Netscape?
Avaya Article: Using Intelligent Presence to Create Smarter Business Applications
Intel Go Parallel Article: Getting Started with TBB on Windows
Microsoft Article: 7.0, Microsoft's Lucky Version?
Avaya Article: How to Feed Data into the Avaya Event Processor
IBM Article: Developing a Software Policy for Your Organization
Microsoft Article: Managing Virtual Machines with Microsoft System Center
Intel Go Parallel Article: Intel Threading Tools and OpenMP
HP eBook: Storage Networking , Part 1
Microsoft Article: Solving Data Center Complexity with Microsoft System Center Configuration Manager 2007
MORE WHITEPAPERS, EBOOKS, AND ARTICLES
Webcasts
HP Video: StorageWorks EVA4400 and Oracle
HP Webcast: Storage Is Changing Fast - Be Ready or Be Left Behind
Microsoft Silverlight Video: Creating Fading Controls with Expression Design and Expression Blend 2
MORE WEBCASTS, PODCASTS, AND VIDEOS
Downloads and eKits
Red Gate Download: SQL Toolbelt and free High-Performance SQL Code eBook
Iron Speed Designer Application Generator
MORE DOWNLOADS, EKITS, AND FREE TRIALS
Tutorials and Demos
Silverlight 2 App and Walkthrough: Leverage Silverlight 2 with SQL Server and XML
IBM Article: Enterprise Search--Do You Know What's Out There?
HP Demo: StorageWorks EVA4400
Microsoft Article: The Progress and Promise of Deep Zoom
Microsoft How-to Article: Get Going with Silverlight and Windows Live
MORE TUTORIALS, DEMOS AND STEP-BY-STEP GUIDES