[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Another Netscape Bug (and possible security hole)

To: [email protected] (Cypherpunks Mailing List)
Subject: Re: Another Netscape Bug (and possible security hole)
From: [email protected] (Futplex)
Date: Fri, 22 Sep 1995 02:52:36 -0400 (EDT)
In-Reply-To: <[email protected]> from "Ray Cromwell" at Sep 22, 95 02:12:22 am
Reply-To: [email protected] (Cypherpunks Mailing List)
Sender: [email protected]

Ray Cromwell writes:
> I've found a Netscape bug which I suspect is a buffer overflow and
> may have the potential for serious damage. If it is an overflow bug,
> then it may be possible to infect every computer which accesses a web
> page with Netscape. To see the bug, create an html file containing
> the following:

Oh brother, this is unbelievable !

I'm using Netscape 1.1N under SunOS 4.1.2.

It turns out that the same (or a similar) flaw resides in the Open Location
input routine -- perhaps this merely coincides with the code called when a
URL is clicked. Anyway, pasting a URL with an overlong domain name a la Ray's
example causes two things:

(1) Part of the Open Location window widget, below the entry box, gets
overwritten onscreen with a portion of the entered URL.

(2) Netscape crashes with a segmentation fault (no core dump that I can see).

-Futplex <[email protected]>

Follow-Ups:
- Re: Another Netscape Bug (and possible security hole)
  - From: Ray Cromwell <[email protected]>

References:
- Another Netscape Bug (and possible security hole)
  - From: Ray Cromwell <[email protected]>

Prev by Date: Netscape bug update
Next by Date: Re: Netscape closes up 1 3/8 today!
Prev by thread: Another Netscape Bug (and possible security hole)
Next by thread: Re: Another Netscape Bug (and possible security hole)
Index(es):
- Date
- Thread