Some of these instructions may change slightly from one browser version to the next. 'At this point it's very unsafe to run Netscape Mail, or even use Netscape as a browser on untrusted sites,' Brumleve said.York University. The second hole is more dangerous, and is only found in Netscape: It 'allows Java to access arbitrary URLs, including local files.' One is specific to the Java language: This hole 'allows Java to open a server that can be accessed by arbitrary clients,' Brumleve wrote on his site. Since developing the applet, Brumleve's site has received more than 200,000 hits, and thousands of people have downloaded the Brown Orifice source code.īrumleve's applet exploits two different flaws in Java, he said. I was surprised that nobody has done it until now.' He said that once he realized the flaw, 'it didn't take very long to find out how to make the program. The applet can be easily used as a Napster-like file sharing utility, Brumleve said, giving a community of users access to files on each other's computers.īrumleve spent Saturday at a San Francisco Internet cafe showing off Brown Orifice and said many people there were using it for file-trading purposes.īrumleve discovered the bug in Netscape while 'messing around' with Java last week. Some in the hacker community speculated on Brown Orifice's non-malicious uses. Preview Release 2 of Netscape 6, which does not contain the vulnerability, is available now at the company's website. Weinstein added that in a few months, the company will release version 6 of its browser, which is not vulnerable to the security hole. Then, users should make sure that the 'Enable Java' option is not checked. To turn off Java, a Netscape user should click on the 'Edit' menu, choose 'Preferences,' and then choose the 'Advanced' option. 'We plan to make a patch available, but in the interim, users can protect themselves by simply turning off Java,' said Andrew Weinstein, a spokesman for the company. Netscape officials said that they are aware of the problem, and that engineers are working on a fix. Brumleve said that the applet would run on versions 4.5 to 4.7 of Netscape Communicator, on Windows-based, and Linux-based computers.

Turn off security on netscape 7.0