PT-1999-1678 · Netscape · Netscape Communicator

Published 1999-10-05 · Updated 2016-10-18 · CVE-1999-1357

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Netscape Communicator versions 4.04 through 4.7

Description: The issue allows remote attackers to attack other clients via cross-site scripting in CGI programs that do not filter certain characters. Specifically, Netscape Communicator converts the 0x8b character to a "<" sign, and the 0x9b character to a ">" sign.

Recommendations: For Netscape Communicator versions 4.04 through 4.7, consider filtering the 0x8b and 0x9b characters in CGI programs to prevent cross-site scripting attacks. As a temporary workaround, restrict the use of CGI programs that do not filter these characters until a more permanent solution is available.

Fix

Related Identifiers

CVE-1999-1357

Affected Products

Netscape Communicator

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-1999-1357 · Security Note
• http://marc.info/?l=bugtraq&m=93915331626185&w=2 · Note