Bugtraq mailing list archives

Re: Netscape Communicator 4.5 can read local files


From: trev () KICS BC CA (Trev)
Date: Wed, 25 Nov 1998 14:13:05 -0800


At 12:48 PM 11/25/98 -0500, Ben Collins wrote:
If some one here can setup a webpage, send me the URL, have that page read
the file '/test.txt' from my hardrive and then that person send the
contents to this list, I will believe. Otherwise I think this whole
hysteria over 'unforseen' dangers should stop.

I've whipped up a couple of demos of this bug that send the contents to a
cgi.  There is a windows version that I know works, and a unix version I
can't test because my linux box is down (it's a hardware thing).  This is
for anyone who has doubts....

http://www.kics.bc.ca/~trev/cgi-bin/test.html (Windoze)

http://www.kics.bc.ca/~trev/cgi-bin/test-unix.html (UNIX)

And yes, it can email it to you if you like :)

Trev



Current thread: