An exploit has recently been reported and confirmed across platforms for Netscape Communicator 4.72 and earlier in which a hostile site can read the links in a user's bookmark file if the user's profile name and the Communicator installation directory path are known to the hostile site. Subsequent analysis has shown that it is also possible to read some HTML file attributes such as the document title and links (but not the complete text) of other HTML files on the hard drive. Netscape takes all reported security and privacy issues seriously, and this exploit has been fixed in Netscape Communicator 4.73, which is available for download from Netscape's site at http://home.netscape.com/download/. From May 5th, Netscape Communicator 4.73 is expected to be available for download via SmartUpdate as well.

For this exploit to be possible, all of the following conditions must be satisfied:

• The hostile site must know the path name of the Communicator installation directory and the user's profile name (such as "default")
• JavaScript must be enabled
• Cookies must be enabled

In evaluating the severity of this exploit, users should keep the following things in mind:

• There are no known instances of malicious use of this exploit on the web
• An HTML file's complete text cannot be read; only certain file attributes (such as the links in the document and its title) can be read
• Even a successful execution of the exploit is a read-only violation of privacy which does not enable the corruption or modification of the user's machine, system, or data

Netscape always recommends that users use the latest available version of its software. Users of releases prior to 4.73 can avoid this exploit by doing any one of the following things:

• Renaming the user's profile name to something other than "default" and not releasing this profile name to untrusted individuals or web sites.
  1. Start Netscape Communicator's User Profile Manager (on Windows, choose Start --> Programs --> Netscape Communicator --> Utilities --> User Profile Manager)
  2. Select the name of profile you wish to change (e.g. "Default")
  3. Click Rename button
  4. Type in a new name other than Default
  5. Thereafter, do not reveal this profile name to any web site or to individuals you do not trust.

• Setting Cookies to "Warn me before accepting a cookie," and refusing cookies from sites you do not trust.
  1. From the Edit pulldown menu, select Preferences.
  2. Click Advanced.
  3. Check "Warn me before accepting a cookie."
  4. Thereafter, when a web site attempts to set a cookie, if you do not trust the web site, click "Cancel" on the alert box that warns you about the cookie being set.

• Disabling cookies.
  1. From the Edit pulldown menu, select Preferences.
  2. Click Advanced.
  3. Check "Disable cookies."

• Disabling JavaScript.
  1. From the Edit pulldown menu, select Preferences.
  2. Click Advanced.
  3. Uncheck the "Enable JavaScript" checkbox.