CVE-2002-1204 Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail passwor...
MediumCVSS 5.0
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Netscape Communicator 4.x allows attackers to use a link to steal a user's preferences, including potentially sensitive information such as URL history, e-mail address, and possibly the e-mail password, by redefining the user_pref() function and accessing the prefs.js file, which is stored in a directory with a predictable name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netscape communicator | = 4.6 | No fix listed |
| netscape communicator | = 4.7 | No fix listed |
| netscape communicator | = 4.61 | No fix listed |
| netscape communicator | = 4.72 | No fix listed |
| netscape communicator | = 4.73 | No fix listed |
| netscape communicator | = 4.74 | No fix listed |
| netscape communicator | = 4.75 | No fix listed |
| netscape communicator | = 4.76 | No fix listed |
| netscape communicator | = 4.77 | No fix listed |
| netscape communicator | = 4.78 | No fix listed |
References
- 20021119 iDEFENSE Security Advisory 11.19.02c: Netscape Predictable Directory Structure Allows Theft of Preferences File mailing-list
- www.idefense.com vendor-advisory
- netscape-preferences-file(10655) vdb-entry
- 6215 vdb-entry