Executive brief
A security flaw in early versions of Netscape Navigator and the Java Developer's Kit allows malicious web-based programs (applets) to bypass security restrictions. Normally, these programs are restricted to communicating only with the server they originated from; however, this bug allows them to connect to any computer on a network. This could be used by an attacker to scan internal networks or bypass firewalls using a victim's browser as a jumping-off point.
Technical details
A vulnerability exists in the Java Applet Security Manager implementation within Netscape Navigator 2.0 and JDK 1.0. The Security Manager fails to properly enforce the 'same-origin policy' for network connections, which is intended to restrict an applet's socket communications to its host of origin. By exploiting this flaw, a remote attacker can deliver a malicious applet that, once executed in the victim's browser, establishes unauthorized connections to arbitrary IP addresses and ports. This allows for internal network reconnaissance, port scanning, and potential exploitation of other services behind a firewall that would otherwise be unreachable from the public internet.
Affected products
- Netscape Navigator 2.0
- Sun Microsystems Java Developer's Kit 1.0
Timeline
- 1996-03-01: disclosed: Initial publication date