Bugtraq mailing list archives
NeoPlanet Saves all emails in Plain text
From: james () PTM COM (James J. Capone)
Date: Wed, 3 Nov 1999 19:01:09 -0500
DISCLAIMER: This email was also submitted to NeoPlanet before submitted to BUGTRAQ. Look for a fix in the future. Per viewing the Directory structure of the NeoPlanet browser, I found that it caches and saves all the email you send and or reply and or receive, in plain text on the harddrive. It saves the email in a directory called _tempe it is a Subdirectory in the NeoPlanets Main directory. Each email you send, respond to, or receive is easily read from any computer in any text editor I.E. Notepad or Word Pad. Each email saved as a Numbered text file. Example. 0001.txt 0002.txt 0003.txt etc... This email contains all the information in it, The entire header of the email, text, the To: CC: Subject and From. So if you get email with sensitive information in it, Like Passwords and more, It can be read in any area. Also if someone creates an exploit that sees the name of the browser as being "NEOPLANET" then it can attempt to DL all the .txt file in this directory into a private server to be read later. This is only noticed in the Version 5.0 of Neo Planet. Also if you are on a network with a shared drive, the World Per-Say could read all of your emails. FIX: Unknown as of now, The only thing I can think of is to maybe do a read-only on the directory. This is also bad for people on a Network/ Intranet with shared Public access to their computers. James J. Capone _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_- WebMaster http://majestic.webprovider.com WebMaster http://linuxusers.webprovider.com "When you don't know what you want, you often end up where you don't want to be."
Current thread:
- Re: [Re: Amanda multiple vendor local root compromises] Brock Tellier (Nov 01)
- Re: [Re: Amanda multiple vendor local root compromises] Peter Walker (Nov 01)
- Re: [Re: Amanda multiple vendor local root compromises] Robert Watson (Nov 02)
- [debian] New version of nis released Aleph One (Nov 02)
- RFP9907: You, your servers, RDS, and thousands of script kiddies .rain.forest.puppy. (Nov 03)
- UnixWare 7's dtappgather Elias Levy (Nov 03)
- NeoPlanet Saves all emails in Plain text James J. Capone (Nov 03)
- hylafax-4.0.2 local exploit Tellier, Brock (Nov 03)
- IE 5.0 vulnerabilities using HTTP redirection Georgi Guninski (Nov 04)
- <Possible follow-ups>
- Re: [Re: Amanda multiple vendor local root compromises] Alexandre Oliva (Nov 02)
- Re: [Re: Amanda multiple vendor local root compromises] Bruce A. Mah (Nov 02)
- Re: [Re: Amanda multiple vendor local root compromises] Frank Crawford (Nov 03)
- Re: [Re: Amanda multiple vendor local root compromises] Alexandre Oliva (Nov 03)
- Re: [Re: Amanda multiple vendor local root compromises] Peter Walker (Nov 01)