NODE 6dc44947More about Netscape Bug finder
Robert Hettinga <rah@shipwright.com>Tue, 17 Jun 1997 10:55:50 +0800
--- begin forwarded text
Date: Mon, 16 Jun 1997 18:24:32 -0500
From: Bill GL Stafford <springco@arn.net>
Organization: Spring Management Company
MIME-Version: 1.0
To: "dcsb@ai.mit.edu" <dcsb@ai.mit.edu>
Subject: More about Netscape Bug finder
X-Priority: 3 (Normal)
Sender: bounce-dcsb@ai.mit.edu
Precedence: bulk
Reply-To: Bill GL Stafford <springco@arn.net>
Christian Orellana, gambled $1000 and lost. Not the worst thing he could
have done. Now the world knows how Netscape approaches a potential
crisis. They did not panic although they may have come close to it. I've
seen that much lost in a cloak room with a pot not near as big as Christian
sought. Anyway you look at it it's just a roll of the dice.Bill GL Stafford
springco@arn.net
Wired Magazine on web
An Email Trail from Bug Spotter to
Netscape
6:01pm 13.Jun.97.PDT The following is a copy of the
email exchange between Netscape officials and
Christian Orellana, the Danish consultant who
found the Netscape Navigator bug. A copy of the
text was provided to Wired News by Netscape and
appears unedited. Wired News has chosen not to
publish Orellana's email address.
Subject: Major security bug in Netscape
Navigator 3 and 4
Date: Mon, 9 Jun 1997 19:19:13 +0200
From: Christian Orellana
To: stracy@netscape.com
Hello!
We have discovered a major security bug in
Netscape Navigator 3.0, which remains uncorrected
in the new Communicator release. The bug affects
Navigator running on all platforms in the standard
configuration.
The bug allows access to any file on the clients file
system, and does not affect Microsoft Internet
Explorer.
This bug is potentially very interesting to Netscape
considering that the new release of Navigator is due
in just three days.
The bug has not previously been reported, and
remains unknown to anyone but us (to the best of our
knowledge). Please get back to us a.s.a.p. (before
Netscape DevCon) if this knowledge is of any interest
to you. You can reach me at the phone number
below.
I have tried to reach Netscape for a while now, and if
Netscape remains uninterested in the issue I may
contact some other interested parties.
Yours sincerely,
Christian Orellans [sic]
---
Subject: Please confirm
Date: Mon, 9 Jun 1997 20:14:08 +0200
From: Christian Orellana
To: stracy@netscape.com
Hello!
Could you please confirm that you have received my
previous letter.
Also I would like to restate my claim that this is of the
utmost importance for the upcoming launch of
Communicator. The bug allows complete read access
to the clients hard disk.
Christian Orellana.
---
Subject: Re: [Fwd: Major security bug in
Netscape Navigator 3 and 4]
Date: Mon, 09 Jun 1997 11:51:04 -0700
From: edithg@netscape.com (Edith Gong)
Organization: Netscape Communications
To: Shannon Tracy , lalam@netscape.com
References:
<339C3C32.FE3F5683@netscape.com>
Shannon,
I don't know what else to do. Can someone in DSE
contact this person to get the details by phone. We
can't investigate until we understand what the issue is.
I'll see if someone in tech support can contact the
customer
Edith
---
Subject: Re: Please confirm
Date: Mon, 09 Jun 1997 12:00:03 -0700
From: Shannon Tracy
Organization: Netscape Communications
To: Christian Orellana
References:
Dear Christian Orellana:
Yes, I received your message. The project manager
just responded that they are trying to find someone to
contact you, however, we can't investigate until we
understand what the issue is. Can you please furnish
a few additional details so that we know who best
might be able to handle this situation?
Thanks,
Shannon Tracy
---
Subject: Re: Please confirm
Date: Mon, 9 Jun 1997 21:11:44 +0200
From: Christian Orellana
To: stracy@netscape.com (Shannon Tracy)
References:
Dear Shannon.
In short the first version of the bug I had up and
running allowed me to get any file whose path I knew
on the clients hard disk. I just got another version up
and running, and considering that the location of
quite a few files on a typical windows/mac/unix
installation is pretty well known, it should be no
surprise that this new version can actually scan the
clients harddisk for specific files, and download them.
I can not reveal much more detail, without giving
away the bug, which I will not do, since I think this
information is so valuable to Netscape that it should
be worth a good deal of money. The information is
certainly worth a bit on the free market, and I am
currently awaiting responses from other parties.
In other words I think the person most suited for
handling this, is someone in charge of the company
check book (-;
Regards - Christian
---
Subject: final note on Navigator bug
Date: Mon, 9 Jun 1997 23:07:59 +0200
From: Christian Orellana
To: stracy@netscape.com (Shannon Tracy)
Netscape:
I think my approach to you on this subject has been
fair and serious. I am offering you a piece of
information that I consider of very high value. The
implications of the bug mentioned in previous emails
are immense.
Considering the widespread use of home-banking
software, not to mention the impact on multiuser
systems in the government and corporate sector, like
unix and NT environments, where access to the
encrypted password-files would render the systems
extremely vulnerable, I think all pre Communicator
versions of Navigator (supposing you fix the bug in
Communicator) would be pretty useless. I will leave it
to you to estimate what impact that would have on
Netscape stocks.
I have to inform you that David Gross at CNN is on
hold with the news, and is only waiting for me to give
him the final demonstration, to verify the bug.
I must also inform you that CNN is not the only
interested party, and that I will consider my options
once I get Netscape's standpoint on the matter.
I would be more than happy to give a demonstration
of the bug, under controlled circumstances, but we
would have to sign some sort of agreement first.
Regards, Christian Orellana.
---
Subject: Re: [Fwd: Major security bug in
Netscape Navigator 3 and 4]
Date: Thu, 12 Jun 1997 16:40:33 -0700
From:chrish@netscape.com (Chris Holten)
Organization: Netscape Communications
To:chrish@netscape.com
References: 1
Subject: Major security bug in Netscape
Navigator 3 and 4
Date: Mon, 9 Jun 1997 19:19:13 +0200
From: Christian Orellana
To: stracy@netscape.com
Hello!
We have discovered a major security bug in
Netscape Navigator 3.0, which remains uncorrected
in the new Communicator release. The bug affects
Navigator running on all platforms in the standard
configuration. The bug allows access to any file on
the clients file system, and does not affect Microsoft
Internet Explorer.
This bug is potentially very interesting to Netscape
considering that the new release of Navigator is due
in just three days.
The bug has not previously been reported, and
remains unknown to anyone but us (to the best of our
knowledge).
Please get back to us a.s.a.p. (before Netscape
DevCon) if this knowledge is of any interest to you.
You can reach me at the phone number below.
I have tried to reach Netscape for a while now, and if
Netscape remains uninterested in the issue I may
contact some other interested parties.
Yours sincerely,
Christian Orellans
---
Subject: Please confirm
Date: Mon, 9 Jun 1997 20:14:08 +0200
From: Christian Orellana
To: stracy@netscape.com
Hello!
Could you please confirm that you have received my
previous letter.
Also I would like to restate my claim that this is of the
utmost importance for the upcoming launch of
Communicator. The bug allows complete read access
to the clients hard disk.
Christian Orellana.
For help on using this list (especially unsubscribing), send a message to
"dcsb-request@ai.mit.edu" with one line of text: "help".
--- end forwarded text
-----------------
Robert Hettinga (rah@shipwright.com), Philodox
e$, 44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
The e$ Home Page: http://www.shipwright.com/
NODE cd25a69fRe: More about Netscape Bug finder
nexus@eskimo.com (Brian Lane)Sat, 28 Jun 1997 23:38:35 +0800
On Mon, 16 Jun 1997 22:41:24 -0400, you wrote:
>An Email Trail from Bug Spotter to
> Netscape
> 6:01pm 13.Jun.97.PDT The following is a copy of the
> email exchange between Netscape officials and
[rest snipped]
Notice that none of this exchange is signed in any way. I don't
doubt Netscape's claim as to what happened, but really this is just a
bunch of letters assembled in the right order. There's no reason to
trust the contents.
Brian
----------------------------------------------------------------------------------
Brian C. Lane http://www.eskimo.com/~nexus KC7TYU
----------- 1024/57B17CA9 96B9 C123 5C90 BECC 6A1F 7DC6 4F2B A26E -------------
NODE 3650e606Re: More about Netscape Bug finder
"Lynne L. Harrison" <lharrison@mhv.net>Sun, 29 Jun 1997 00:50:32 +0800
At 03:32 PM 6/28/97 GMT, Brian Lane wrote:
>
>On Mon, 16 Jun 1997 22:41:24 -0400, you wrote:
>
>>An Email Trail from Bug Spotter to
>> Netscape
>> 6:01pm 13.Jun.97.PDT The following is a copy of the
>> email exchange between Netscape officials and
>
>[rest snipped]
>
> Notice that none of this exchange is signed in any way. I don't
>doubt Netscape's claim as to what happened, but really this is just a
>bunch of letters assembled in the right order. There's no reason to
>trust the contents.
This reminded me to ask if anyone knows if, per their statement, Netscape
intends to u/l a patch for the 3.x versions. When I checked yesterday, I
didn't see any reference to it.
*********************************************************
Lynne L. Harrison, Esq. | "The key to life:
Poughkeepsie, New York | - Get up;
lharrison@mhv.net | - Survive;
http://www.dueprocess.com | - Go to bed."
************************************************************
DISCLAIMER: I am not your attorney; you are not my client.
Accordingly, the above is *NOT* legal advice.
NODE 18f17045Re: More about Netscape Bug finder
Tom Weinstein <tomw@netscape.com>Sun, 29 Jun 1997 07:03:14 +0800
Lynne L. Harrison wrote:
>
> At 03:32 PM 6/28/97 GMT, Brian Lane wrote:
> >
> >On Mon, 16 Jun 1997 22:41:24 -0400, you wrote:
> >
> >>An Email Trail from Bug Spotter to
> >> Netscape
> >> 6:01pm 13.Jun.97.PDT The following is a copy of the
> >> email exchange between Netscape officials and
> >
> >[rest snipped]
> >
> > Notice that none of this exchange is signed in any way. I don't
> >doubt Netscape's claim as to what happened, but really this is just a
> >bunch of letters assembled in the right order. There's no reason to
> >trust the contents.
>
> This reminded me to ask if anyone knows if, per their statement,
> Netscape intends to u/l a patch for the 3.x versions. When I checked
> yesterday, I didn't see any reference to it.
Yes, we're working on a patch for 3.x. It's somewhat harder to do than
patching 4.0 because we weren't set up to build 3.x anymore. For some
of the weirder Unix platforms we had to reinstall older versions of
compilers and OSes.
--
What is appropriate for the master is not appropriate| Tom Weinstein
for the novice. You must understand Tao before | tomw@netscape.com
transcending structure. -- The Tao of Programming |
NODE d9096426Re: More about Netscape Bug finder
Mike Duvos <enoch@zipcon.net>Tue, 17 Jun 1997 13:13:00 +0800
A few comments...
Almost every non-trivial program which runs on a platform which does not
shield the OS from applications can be subverted to give access to the
target machine.
This is hardly news. The fact that a determined Dane with a debugger
managed to poke through the code and break something is neither
earth-shattering nor remarkable.
In something the size of Netscape, I'm sure 999,999 exploits still remain.
The company is hardly going to start writing checks every time someone
finds one of them.
Until all application software runs on secure virtual machines, or passes
bytecode verification and formal proofs of correctness, this problem will
continue to exist, not only in Netscape, but in every other large
application as well.
Big Yawn.
--
Mike Duvos $ PGP 2.6 Public Key available $
enoch@zipcon.net $ via Finger. $