cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-09-22 - YET ANOTHER BAD NETSCAPE HOLE!

Header Data

From: Ray Cromwell <rjc@clark.net>
To: cypherpunks@toad.com
Message Hash: fe2dd810320cbf1d499e020ccc2c77e38cd9ff7dd8f2353f707a1b234eff9bbd
Message ID: <199509220830.EAA13828@clark.net>
Reply To: <9509220814.AA06967@cs.umass.edu>
UTC Datetime: 1995-09-22 08:30:13 UTC
Raw Date: Fri, 22 Sep 95 01:30:13 PDT

Raw message

From: Ray Cromwell <rjc@clark.net>
Date: Fri, 22 Sep 95 01:30:13 PDT
To: cypherpunks@toad.com
Subject: YET ANOTHER BAD NETSCAPE HOLE!
In-Reply-To: <9509220814.AA06967@cs.umass.edu>
Message-ID: <199509220830.EAA13828@clark.net>
MIME-Version: 1.0
Content-Type: text/plain


> 
> On the bright side, mailto: hyperlinks containing extra-long domain names
> seem to be handled comparatively safely in both Netscape and Mosaic. 
> (Perhaps they just have longer buffers ? ;)

  Good question. My guess is, Netscape doesn't do any processing on the
mailto: hyperlink at all, but merely passes it to a real mail delivery
agent like Sendmail (or it uses MAPI under Win'95). Which begs
the question, if Netscape is executing an external delivery agent,
there may be the possiblity of sneaking an attack in there and getting
the shell to execute something.

Hmm, let me try something.


WOW!! Unbelievable! Stop the presses! I Can't believe no one ever discovered
this before! Try a page with the following URL

 test 

Muahaha! Yet another security hole! Clicking on this mailto brings up
an xterm on my machine!  Simply change the xterm& to "rm -rf /" and
bingo!


Sheesh. I better stop before I am on Netscape's most hated list.


-Ray

Thread