OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: MDKSA-2000:036 - netscape update
From: Kris Kennaway (krisFREEBSD.ORG)
Date: Mon Aug 28 2000 - 10:54:26 CDT

On Mon, 21 Aug 2000, Linux Mandrake Security Team wrote:

> Problem Description:
>
> There exists a problem in all versions of Netscape from 4.0 to 4.74
> with Java enabled. Under certain conditions, Netscape can be turned
> into a server that serves files on your local hard drive that Netscape
> has read access to and remote people can access it by connecting their
> web client to port 8080 on your machine if they know the IP address.
> This vulnerability has been fixed in Netscape 4.75.

This is not the vulnerability at all, but a single instance of an exploit
for it.

IMO, this advisory is misleading since just blocking port 8080 does not
work around the problem.

Kris 

--
In God we Trust -- all others must submit an X.509 certificate.
    -- Charles Forsythe <forsythealum.mit.edu>