CVE-1999-1130

Description

Default configuration of the search engine in Netscape Enterprise Server 3.5.1, and possibly other versions, allows remote attackers to read the source of JHTML files by specifying a search command using the HTML-tocrec-demo1.pat pattern file.

Affected products

• netscape / enterprise_server3.5.1

Exploits & proofs of concept

• exploit-dbNetscape Enterprise Server 3.51/3.6 - JHTML View Sourceby David Litchfield

References

• MAILING_LISThttp://marc.info/?l=bugtraq&m=93346448121208&w=2
• MAILING_LISThttp://marc.info/?l=ntbugtraq&m=93337389603117&w=2
• MISChttp://www.securityfocus.com/bid/559