[Previous] [Next] [Index]
[Thread]
Netscape 2.01 & JavaScript
-----BEGIN PGP SIGNED MESSAGE-----
Question for JavaScript hackers:
This is the quote from the "Netscape:Security Enhancements" page (at
http://www.netscape.com/newsref/std/java_security.htm):
Another feature of JavaScript is the ability for a server script
to list files and directories. In Netscape Navigator 2.0, a
JavaScript application could list the file names and directories
on the user's machine. Although JavaScript applications cannot
view or change the contents of any local files or directories,
being able to list file names and directories is a privacy
concern. Navigator 2.01 fixes this problem by refusing to allow a
script from a server to view file names and directory listings on
the local user's machine.
With the UNIX version of Netscape Navigator 2.01, specifically the
SunOS 4.1.3_U1, a JavaScript "exploit" example can still read and
display the root filesystem in a window to me (e.g.:
http://www.c2.org/~aelana/javascript.htm ). My question is this
... is that information unavailable to the server [convince me] and
only available to display in a client window, or is the bug still
there? The "Disable JavaScript" button does take care of this, of
course, but I am wondering whether I am misreading the above
paragraph, if this is a non-problem, or if there is still a "privacy
vulnerability" in Navigator 2.01.
_rob_
- --
Rob Jenson, Sr. Systems Engineer, Hughes STX Corp.
NASIRC (NASA Automated Systems Incident Response Capability)
E-mail: jenson@nasirc.hq.nasa.gov F:(301) 441-1853 V:(301) 441-4266
Snail: Ste. 400, 7701 Greenbelt Rd., Greenbelt, MD 20770
Get PGP Key from http://www-swiss.ai.mit.edu/~bal/pks-toplev.htm
Verify: pub 1717/E7A75FC9 1995/10/25 Rob Jenson <jenson@nasirc.nasa.gov>
Fingerprint: D8 4E 05 2D 98 1B D5 79 D1 27 AB A3 93 E5 75 25
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface
iQDsAwUBMUnkg5+zdHXnp1/JAQFjDga0Dbm/UTYaeblJKpuHoT488t3R0ibRy9Ah
JYh7MGzvja6FGTDhqiCUcIey2AvPmn7VM9dGGDpCh2O709yFJbZknBT6w6x6sSZX
xVaf9HJGnueFWaqR3tsseltdp3xR/7cwROB8v5fKfcYPhJCK8fO56KdmlEtN3eXL
bFDfumpEWyxROCiHUwN6JqDax4o60K9RdLCggo8A4ZKxUsAMO0PIIJpEA5h6mdtj
sd02XnegfZjxgXNwI7bmezg1bwVMnXXPSF7MtpXIY7oH6gZ21m5q0L//zI3dh8c=
=v36h
-----END PGP SIGNATURE-----