Netscape Communicator type=password Browser Buffer Overflow Vulnerability
BID:1726
Info
Netscape Communicator type=password Browser Buffer Overflow Vulnerability
| Bugtraq ID: | 1726 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 28 2000 12:00AM |
| Updated: | Sep 28 2000 12:00AM |
| Credit: | Posted to Bugtraq on September 28, 2000 by Michal Zalewski <[email protected]>. |
| Vulnerable: |
Netscape Communicator 4.76 Netscape Communicator 4.75 Netscape Communicator 4.74 Netscape Communicator 4.72 Netscape Communicator 4.61 Netscape Communicator 4.51 Netscape Communicator 4.7 Netscape Communicator 4.6 Netscape Communicator 4.5 Netscape Communicator 4.0 |
| Not Vulnerable: |
Netscape Communicator 6.2.3 Netscape Communicator 6.1 Netscape Communicator 4.79 Netscape Communicator 4.78 Netscape Communicator 4.77 |
Discussion
Netscape Communicator type=password Browser Buffer Overflow Vulnerability
Netscape Communicator is susceptible to a buffer overflow when viewing a HTML document with an INPUT tag containing the argument 'type=password' consisting of over 16 KB.
For example, the following code embedded in a HTML document will cause the browser to crash (the 'O' in FORM has been replaced with a zero):
<F0RM action=something method=something>
<INPUT type=password value=16_KB_character_string>
</F0RM>
Depending on the data entered, arbitrary code execution may be made possible but this has not been verified. Only the 'password' type is vulnerable to this exploit. A restart of the application is required in order to regain normal functionality.
Netscape Communicator is susceptible to a buffer overflow when viewing a HTML document with an INPUT tag containing the argument 'type=password' consisting of over 16 KB.
For example, the following code embedded in a HTML document will cause the browser to crash (the 'O' in FORM has been replaced with a zero):
<F0RM action=something method=something>
<INPUT type=password value=16_KB_character_string>
</F0RM>
Depending on the data entered, arbitrary code execution may be made possible but this has not been verified. Only the 'password' type is vulnerable to this exploit. A restart of the application is required in order to regain normal functionality.
Exploit / POC
Netscape Communicator type=password Browser Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Netscape Communicator type=password Browser Buffer Overflow Vulnerability
Solution:
FreeBSD has released an advisory. Users are advised to upgrade their ports tree and rebuild the relevant Netscape port. Further details are available in the referenced advisory.
SGI has released an advisory. IRIX 6.5.13 and later ships with non-vulnerable versions of Netscape. Users are advised to upgrade to IRIX 6.5.13 or later. Further details are available in the referenced advisory.
The following fixes are available:
Netscape Communicator 4.75
Solution:
FreeBSD has released an advisory. Users are advised to upgrade their ports tree and rebuild the relevant Netscape port. Further details are available in the referenced advisory.
SGI has released an advisory. IRIX 6.5.13 and later ships with non-vulnerable versions of Netscape. Users are advised to upgrade to IRIX 6.5.13 or later. Further details are available in the referenced advisory.
The following fixes are available:
Netscape Communicator 4.75
-
Red Hat Inc. 6.0 i386 netscape-common-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.0/i386/netscape-common-4.76-0.6.2.i386.rpm -
Red Hat Inc. 6.0 i386 netscape-communicator-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.0/i386/netscape-communicator-4.76-0.6.2.i38 6.rpm -
Red Hat Inc. 6.0 i386 netscape-navigator-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.0/i386/netscape-navigator-4.76-0.6.2.i386.r pm -
Red Hat Inc. 6.1 i386 netscape-common-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.1/i386/netscape-common-4.76-0.6.2.i386.rpm -
Red Hat Inc. 6.1 i386 netscape-communicator-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.1/i386/netscape-communicator-4.76-0.6.2.i38 6.rpm -
Red Hat Inc. 6.1 i386 netscape-navigator-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.1/i386/netscape-navigator-4.76-0.6.2.i386.r pm -
Red Hat Inc. 6.2 alpha netscape-common-4.76-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-common-4.76-0.6.2.alpha.rp m -
Red Hat Inc. 6.2 alpha netscape-communicator-4.76-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-communicator-4.76-0.6.2.al pha.rpm -
Red Hat Inc. 6.2 alpha netscape-navigator-4.76-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-navigator-4.76-0.6.2.alpha .rpm -
Red Hat Inc. 6.2 i386 netscape-common-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-common-4.76-0.6.2.i386.rpm -
Red Hat Inc. 6.2 i386 netscape-communicator-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-communicator-4.76-0.6.2.i38 6.rpm -
Red Hat Inc. 6.2 i386 netscape-navigator-4.76-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-navigator-4.76-0.6.2.i386.r pm -
Red Hat Inc. 7.0 i386 netscape-common-4.76-1.i386.rpm
ftp://updates.redhat.com/7.0/i386/netscape-common-4.76-1.i386.rpm -
Red Hat Inc. 7.0 i386 netscape-communicator-4.76-1.i386.rpm
ftp://updates.redhat.com/7.0/i386/netscape-communicator-4.76-1.i386.rp m -
Red Hat Inc. 7.0 i386 netscape-navigator-4.76-1.i386.rpm
ftp://updates.redhat.com/7.0/i386/netscape-navigator-4.76-1.i386.rpm -
Wirex Immunix 6.2 netscape-common-4.76-0.6.2
http://www.immunix.org:8080/ImmunixOS/6.2/updates/RPMS/netscape-common -4.76-0.6.2.i386.rpm -
Wirex Immunix 6.2 netscape-communicator-4.76-0.6.2
http://www.immunix.org:8080/ImmunixOS/6.2/updates/RPMS/netscape-commun icator-4.76-0.6.2.i386.rpm -
Wirex Immunix 6.2 netscape-navigator-4.76-0.6.2
http://www.immunix.org:8080/ImmunixOS/6.2/updates/RPMS/netscape-naviga tor-4.76-0.6.2.i386.rpm -
Wirex Immunix 7.0-beta netscape-common-4.76-1
http://www.immunix.org:8080/ImmunixOS/7.0-beta/updates/RPMS/netscape-c ommon-4.76-1.i386.rpm -
Wirex Immunix 7.0-Beta netscape-communicator-4.76-1
http://www.immunix.org:8080/ImmunixOS/7.0-beta/updates/RPMS/netscape-c ommunicator-4.76-1.i386.rpm
References
Netscape Communicator type=password Browser Buffer Overflow Vulnerability
References:
References:
- Netscape Security (Netscape)