Big Day For Browser Vulnerabilities

An anonymous reader writes "All browsers have been reported vulnerable to different vulnerabilities today. Starting with: Internet Explorer on XP SP1/SP2, which suffers a new system compromise (of course) vulnerability. Continuing with: Opera, Mozilla / Mozilla Firefox / Camino, Safari, Netscape, Konqueror, Avant Browser and Maxthon, which all suffers some new spoofing vulnerabilitities. Demonstrations of the spoofing vulnerabilities are available here and here."

NY Times Ad...

Stop the presses.

Re:NY Times Ad...

Bug seems to be fixed in Firefox already.

Gentlemen (and Ladies), start your check for updates! (Tools, Options, Advanced, Check Now button)

Re:NY Times Ad...

You don't expect them to backport updates to all beta releases, do you?

Once Firefox 1.0 hits the shelves I'm sure it will get security updates for a long time even after it isn't the latest and greatest version.

Re:NY Times Ad...

Actually, according to MozillaZine [mozillazine.org] the fix has been fixed in the 1.0 code tree, but hasn't been merged into the existing builds yet. I would expect a fix before 1.0 goes gold.

Re:Throw in the "of course" to bash IE

wrong, it's because the IE is a SYSTEM compromise whereas the others just expose the USER

hence the OF COURSE because of the poor choice of integrating the browser into the system

Been thinking about this...

So, a fairly common problem in all browsers bar IE (does it affect those browsers that embed IE to give tabs?)

Possibly solutions that I've just thought up (for discussion)

• Make the website launching any JavaScript event appear in the foreground
• Make every dialog box give security information about the website it's from, if the website it's from is not the currently displayed tab.
• Suspend various types of JavaScript until the tab is foremost again, but display a 'requires your attention' icon (I call shotgun on a panda [pandasecurity.com] for this)

While they're fixing this, if all browser makers could make sure there's an option to stop websites resizing my browser, that'd be lovely. I know Moz has this, so it can't be hard for everyone to have it.

Re:Been thinking about this...

I would be more in favor of a tab not opening a dialog or firing any other events until it becomes active again. Allowing tabs to gain focus without user intervention has the potential to be annoying as hell. For example, an ad on a page could keep popping that tab to the front for you to see it. Ugh.

Re:Been thinking about this...

I would be more in favor of a tab not opening a dialog or firing any other events until it becomes active again

That would alleviate the real problem slightly, but it wouldn't begin to address the general problem that javascript is given too much detailed control over the user interface. There are other ways to spoof websites, if you can get between the site and the user in any fashion.

Basically, window creation should be under the user's control. It should always be obvious that any browser window, whether it's a dialog box or a pop-up window, is a browser window. It should have enough decorations to make sure you can't confuse it with a local application. Resizable windows and dialog boxes should be optional in all browsers if they're available at all, so that web designers have an incentive to create sites that work completely in a standard window.

Re:Whats with the dig at IE?

The advisories list the IE problems as much highly critical, whereas the others are only medium critical.

As I understand it, problem with IE vulns are that its SO tied to the OS, that even the most trivial of problems can cause much greater problems.

Re:The Mozilla exploits are a JOKE

onload = "setTimeout('document.evil_form.submit()' ,10000)"

???

Re:Whats with the dig at IE?

>> The Mozilla etc problem seems equally serious.

Let's pretend, for a minute, that a system compromising vulnerability is "equally serious" as a spoofed URL. This will take some imagination and serious role-play, but we can do it.

Now that we have that in place, let's look at this issue: when will the Mozilla development team fix the issue, and when will Microsoft?

I don't know about you, but my money's on Mozilla.

WARNING: Don't click on link.

The Last Measure link contains stuff you really don't want to be seeing. Don't click on it if you're just looking for a demo of the popup style.

You have to be kidding.

The Mozilla etc problem seems equally serious.

Mozilla etc... "If the user explicitly opens a page in a background tab, it may not be possible to tell what webpage a dialog box is associated with". Note that the exploit can not open a page in a background tab, it can only take advantage of that if it happens.

Exposure: If the user can first be tricked into opening a page in another tab, and the exploiter can guess whether the user has "open tabs in background" (or the equivalent option) selected or not, then they may be able to trick them into entering confidential information a little easier. There are other ways to get similar results without having to trick the user twice, using frames or with multi-stage popups.

Internet explorer: The exploit can be used to launch web pages in the local security zone. The hole here is really the fact that there is such a thing as a "local security zone" at all. For seven years now, exploit after exploit has used this design flaw in the HTML control to run arbitary code as the local user. Spyware, viruses, worms, spam bots, over and over again, malicious software has gained its initial foothold through variants of this attack.

Exposure: Visiting a web page can allow an attacker to take over your computer, without any further action on your part.

And you say "The Mozilla etc problem seems equally serious."?

Jesus.

Re:Whats with the dig at IE?

The dig is just desserts. IE sitll can't rid itself of backdoor connections to the OS that do not plague other browsers. These came about in part because of Microsoft naivete [as its programming culture arose in the protected world of standalone office products] and partly from its attempt to defend against DOJ litigation [ aimed at its monopolistic moves to kill Netscape] by claiming that "browsers are naturally part of the OS". Serves 'em right!

Re:Whats with the dig at IE?

The Mozilla etc problem seems equally serious.
Ummm No not really. In fact it does not seem all that much like a bug at all. More like an artifact of using tabs. There are a few fixes that will be easy to put into all the tabbed browsers.
1. When a dialog is opened the requestiing page is brough to the top.
2. Put the calling URL on the Dialogs title bar.
3. Do not dialogs to be displayed if the the calling page is not in the foreground.
The Mozilla/other browser issues "Could" allow someone to be fooled but you would really have to work at it. The IE issue seems to allow the remote execution of code on your system. The potental damage seems much higher to me.
Of course if you are right and they are equal and Mozzilla has a fix before Microsoft then it would show that Mozilla can fix major security issues better than Microsoft.

Everything is vulnerable

it's just that IE is so tied to the OS that when it goes down so does the whole 'puter
-Nb

Phew!

Lynx missed out!

All browsers?

All browsers have been reported vulnerable to different vulnerabilities today.

I use Lynx [isc.org], you insensitive clod!

CDJ

Re:All browsers?

I use Lynx [isc.org], you insensitive clod!

Must you post in HTML? I use telnet to fetch/post my web traffic you insensitive clod! It's people like you who clog up the web! ;)

Re:All browsers?

I use telnet to fetch/post my web traffic you insensitive clod!

Y ME 2 BUT MY IP/OP IS ALL ON PNCH CRDS IT PPLE LKE U WHO CLG UP THE WEB

spoofing demos aren't working on my browser

I guess the best defense is a good slashdotting.

Re:spoofing demos aren't working on my browser

I get it. It tricks the browser into displaying a blank page. Clever bastards.

Safari Exploit demonstration did not work

I just tried the exploit demonstration for Safari, but it did not work. The active tab switched back to the one providing the pop-up, not the target site. Did anyone else try it and have it work?

Re:Safari Exploit demonstration did not work

I just tried the exploit demonstration for Safari, but it did not work. The active tab switched back to the one providing the pop-up, not the target site. Did anyone else try it and have it work?

It switched back for me, too, when using tabs, but not when I opened the URL in another window. It doesn't much matter, though, because I think the point is supposed to be that the dialog could say "Citibank needs your SSN to access your account on our site" and 90% of the people would only know that they just opened the URL, so they'd assume it was related to that page. What's great for the Mac is that there is already an interface element Apple can use to address this issue: the sheet [apple.com]!

Slashdotted already...

Slashdotted already. Would it kill the editors to, you know, edit and provide brief outlines of the stories they're linking to, especially in the case of stories on third party sites that they know will most likely not stand a slashdotting?

It's a clever one.

For those who can't be bothered to RTFA, the Mozilla vulnerability is essentially a standard link with an "onMouseOver" bit which runs a little piece of JavaScript.

The JavaScript pauses for a few seconds (while you presumably get distracted by another page) then flashes up a "Please enter some text" dialogue box.

A similar effect could be achieved by calling the JavaScript on pretty much any event; the vulnerability relies on it being unclear which site caused the dialogue box to pop up. I can see how it could be classed a vulnerability, but it's hardly earth shattering.

Re:It's a clever one.

While I agree with that sentiment on the first exploit (though it would be nice if the parent of the dialog box were displayed when the dialog box is displayed, if the parent is not already active), the second one is a bit more serious.
A form element should not be allowed to steal the focus when it's parent is not active. With a fairly simple timer (like the ones this guys already using), a javascript ...script, could call document.myform.submit after a few minutes to harvest all of the text entered in another page.
Forms should be strictly tied to their containers, and focus requests should be restricted only to the currently active window/tab/whathaveyou. I suspect that the reason this is an issue is because technically the form and the citibank page are both in the same window, the tabs are merely controlling what components are visible at any given point in time.

Re:firefox users update now!

> Re:firefox users update now!

Why?

As far as I can see, there are no updates for this problem.

Am I missing something?

Re:Tabs

That's ridiculous. It has nothing to do with tabs. The same thing would happen with multiple open windows. To come to the conclusion that "tabs are problematic" is asinine.

Vulns text...

For Apple's Safari browser

Description:
Secunia Research has discovered a vulnerability in Safari, which can be exploited by malicious web sites to spoof dialog boxes.

Inactive windows can launch dialog boxes so they appear to be displayed by a web site in another window. This can be exploited by a malicious web site to show a dialog box, which seems to originate from a trusted web site.

Successful exploitation would normally require that a user is tricked into opening a link from a malicious web site to a trusted web site in a new window.

A test is available here:
http://secunia.com/multiple_browsers_dialog _box_sp oofing_test/

The vulnerability has been confirmed in Safari 1.2.3 (v125.9). Other versions may also be affected.

Solution:
Don't visit trusted web sites while visiting untrusted web sites or disable JavaScript.

And for IE

Description:
http-equiv has discovered two vulnerabilities in Internet Explorer, which can be exploited by malicious people to compromise a user's system, link to local resources, and bypass a security feature in Microsoft Windows XP SP2.

1) Insufficient validation of drag and drop events from the "Internet" zone to local resources for valid images or media files with embedded HTML code. This can be exploited by e.g. a malicious web site to plant arbitrary HTML documents on a user's system, which may allow execution of arbitrary script code in the "Local Computer" zone.

This vulnerability is related to:
SA12321

NOTE: Microsoft Windows XP SP2 does not allow Active Scripting in the "Local Computer" zone.

2) A security zone restriction error, where an embedded HTML Help control on e.g. a malicious web site references a specially crafted index (.hhk) file, can execute local HTML documents.

NOTE: This will also bypass the "Local Computer" zone lockdown security feature in SP2.

The two vulnerabilities in combination with an inappropriate behaviour where the ActiveX Data Object (ADO) model can write arbitrary files can be exploited to compromise a user's system. This has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2.

Solution:
Disable Active Scripting or use another product.

Vulnerability report vulnerability

Seems like all the vulnerability reports are vulnerable to reporing them on /.

Robert

Spoofing Demo Vs. Slashdot

Spoofing Demo 0
Slashdot 1

Take that you evil spoofers!

Tabs bug explained

Essentially, it's an interface error. The problem seems to be that dialog boxes don't explain which tab they belong to.

So with some creative coding, properly guessed/estimated delays, you can create the impression that dialog box A belongs to tab X, while it's actually from tab Y.

I'm not sure if it's restricted to tabs. Can't get to the demo sites anymore as they're /.'ed, but I wouldn't be surprised if it works just as well for opening the external site in a new window.

Mozilla*.*

Although they list Mozilla*.* vulnerabilities as not very serious, they must be acknowledged anyway. One is fairly trivial, I've seen it many times: typing in a text box in a tab may send keypresses to a text box in another tab. It happens when I open many tabs at once; the last tab to load usually steals the focus. It's a minor annoyance, though, and can be easily noticed looking at the screen, since typing doesn't appear where it should. However, spoofing dialog boxes can be more serious. Although suspending script execution in inactive tabs could solve this problem, it can break other things.

At any rate, I'm fairly confident this will be solved in a sensible way by Mozilla*.* developers.

About the second tab issue

This was already filed as bug 124750, and has already been fixed. I'm using a 2004-10-19 build, and I can assure I already tested it.

As I can't link bugzilla form Slashdot... go to http://bugzilla.mozilla.org/ and type in there the bug number. (None: it's not marked there as FIXED, but you should look at the "fixed-aviary1.0" keyword, which is what matters for Firefox 1.0)

This is why we need CHROOT browsers

Because the complexity and importance of our web browsers continues to increase, security of those applications will never be "solved" or "fixed".

Other steps must be taken to deal with these issues. What we can do is treat the symptoms.

For those using Linux or UNIX, privilege separation (running the browser process as a user ID that has limited rights) and a chroot jail would be major steps forward.

I believe the browser projects need to work with the community to support that type of runtime configuration.. Before a big nasty vulnerability does damage.

Chroot, in particular, is very tricky.

It's interesting to compare these

This is an excellent example of two facts:

• All software suffers security problems, and many of the security holes are actually just unintended side effects of useful features; and
• Microsoft's software is much, much worse than the rest, because it's plagued by old design decisions that make it easy to turn a minor security problem into a remote root exploit.

Here's what the vulnerabilities are:

In all the non-IE browsers, there's a potential issue with how tabbed browsing works. Basically, the problem is that stuff on tabs other than the active tab can still (a) pop dialogs and (b) have the keyboard focus. It's pretty clear that (b) is just a problem that should be fixed, because although it's possible to concieve of a circumstance where a user would want to look at one tab while typing into a box on another, it's clearly way too surprising and not nearly useful enough to be allowed. But (a) is more interesting. It's a side effect of the fact that pages continue functioning in all ways even when they're not the active tab. This includes running Javascript/Java/Flash programs, loading, rendering, etc. And that's a good and useful thing. But when a background tab pops a dialog, it may appear to the user that the dialog was created by the active page. If the user trusts one page more than the other, that can lead to problems.

The solution to this dialog-popping problem isn't obvious. Perhaps dialogs need to be labeled with the name of the site that created them. Perhaps some other solution. But it will be worked on, even though the risk is fairly small.

The IE vulnerability is very different in that it's a system compromise flaw. It's similar in one way, though: it's caused by a subtle interaction of features. In this case, dragging and dropping of image or media files with embedded HTML code, which may be malicious. This malicious code isn't a problem, really, because IE is security-conscious and won't execute it -- except that Microsoft has that terrible "security zones" design feature. Once the malicious code is moved from the "Internet" zone to the "Local Computer" zone, the code will be executed. What makes it especially funny is that Microsoft fixed this problem in SP2 by changing the Local Computer zone so tht it will no longer execute Active Scripts. But yet another bug in the security zones can be exploited to bypass that "problem" so SP2 is vulnerable as well.

Security flaws are everywhere, but what really kills Microsoft is their rash of bad design decisions in the past, turning little holes into remote root exploits. They're getting better, I believe, but it's going to be a long hard road for them to patch all of the problems that are created by their bad design decisions. It's too late, of course, to change the design. Too much depends on it.

Don't enable Javascript

Don't visit trusted web sites while visiting untrusted web sites or disable JavaScript.

Once again, for all you web masters out there who cannot code a simple <a href="foo"> without using Javascript:

SOME OF US RUN WITH JAVASCRIPT DISABLED BY DEFAULT, FOR GOOD REASON!

Yes, there are plenty of places where you CANNOT do what you need to do without Javascript - in those cases go ahead and use Javascript.

But for a simple link to another page, or to an image, or to simply DISPLAY you site's content (I'm thinking of bone-headed sites like the International Herald Tribune here who use JS to display otherwise hidden text for their stories), USE HTML DAMNIT! OK, if you want to "enhance" (pronounced "clutter up with needless crap") you site by overriding those behaviors IF Javascript is enabled, knock yourselves out (preferably with a large mallet). BUT MAKE STANDARD HTML WORK AS WELL!

Yes, you may WANT your image to be in its own window, without the standard decorations a browser will add. But if I have JS disabled, make the damn link just spawn a new window and be done with it.

Re:Don't enable Javascript

The advice here is sound. There are all sorts of evil things that can be done with javascript. I know how to do some of them and I am one of the 'good guys'. Goodness knows what can be done by those who are less well intentioned. I always run with javascript disabled, simnple as that. Not only does this prevent the problem of pop-ups, it also keeps one safe from many other dangers. If a site requires javascript, then either I will simply not use it, or I will briefly enable javascript only as necessary. One of the reasons I do not own a Subaru, is due to their love of javascript, even though their cars are great. So, webmasters be aware, your choices can influence consumer habits!

NOT that we should ignore vulnerabilities

after all, I love to bash poor Microsoft, but exhaustion is rapidly setting in here. I am what passes for a careful user: I don't use IE, I run the latest Mozilla, I use a firewall and anti-spyware and when its all said and done...not much gets done because I am fretting over yet another patch or vulenrability. I have sympathetic talks with my sysadmins but my family thinks I am the the Home Network Nazi.
I feel like a small town policeman burried under a barrage of "sky-is-falling-alert-level-puce" faxes from the HomelandSecurity to be dealt with on zero budget.
The color codes provided by Secunia are ,despite seeming like imitations of the nation's goofy alert color codes, a step in right direction. But what I want is an alert level made meaningful by contrasting it with risks I do understand: Since we perceive risk as a product of CHANCE_OF_OCCURANCE X COST_OF_OCCURANCE, I want a system where I can set a threshold for ignoring the drivel. The basis could be a chance_of_occurance = to my chances of a serious car accident on the way to work for instance [say its 1 in 5000] and the cost is monitarized in the range from 0$ to the 1.7million [or what ever it is] that the insurance industry pays out on average for a loss of life. ...if I am fithy rich, a vulnerability that opens my brokerage account could be > than loss of life but that is for me to set. All the stuff that falls below the threshold, I don't want to hear about, at least not more than once a year in a round-up batch of patches. Enough already!

MirrorDotting time

1. Microsoft Internet Explorer [mirrordot.org]
2. Opera [mirrordot.org]
3. Mozilla Suite/Firefox [mirrordot.org]
4. Netscape [mirrordot.org]
5. Konqueror [mirrordot.org]
6. Avant [mirrordot.org]
7. Maxthon [mirrordot.org]

Demonstrations of vulnerabilities: here [mirrordot.org] and here [mirrordot.org]

Konqueror work-around

I left Javascript enabled in Konqueror, but set "open new windows" to "ask" in preferences and set the other JS policies to "ignore." Site displayed normally, and the spoofed text entry box didn't launch.

Browser windows must become hierarchical

Browser windows are going to have to become hierarchical. If the code in window A causes the opening of window B, window B must be considered a child of window A. If window A closes, so must window B.

This means popups can't survive their parents, which is probably a good thing.

Visual parenting is needed, too. If the parent window is minimized or goes to the back, so should its child windows. Window headers should reflect the parent window's header.

Child windows shouldn't be allowed to position themselves entirely outside of the parent window. They should have to overlap, at least marginally. (Strict users might turn on a mode where they have to overlap totally, like subwindows in an application.) This creates a visual association between the parent and child windows.

With this, multiple window sites behave in a more tolerable manner.

We need a new view of security

We need to accept that all browsers are fundamentally broken and exposed and can't be fixed. We need therefore to understand security as that set of tools and behaviors that minimize our own exposures and risks with the understanding that Browsers, in fact all desktop tools are to some extent nothing more than Dreadnoughts and Maginot Lines too big and stupid to get out of their own way and only as effective as the stupidity of the attack that tries to hit them head on.

The notion that browsers are exposed is really only relevant in term of what is exposed and how meaningful that exposure might be to you or your enterprise. If your browser gets hijacked - ok then what are you going to lose your bank account or credit card? Are you going to lose your health management PPO records? Are you going to go to jail when the FBI finds your kiddyporn? Or do you simply take other steps to protect yourself in the case when not if your machine is cracked and taken over.

Konqueror vulnerable, really?

I tested the spoof vulnerability in Konqueror 3.3.1 (the latest).

When displaying the popup, it 1) switched back to the tab that owns it, and 2) the popup clearly contained the server name "secunia.com".

I was about to call this unhealthy sensationalism, but I haven't checked out older versions. Can anyone confirm the vulnerability in 3.3.0 and older? Thanks.

Firefox's tabs

The window from an unactive tab coming to the front in Firefox does not really seem like that big of a deal. I kind of like the fact that it does this. At work, the server needs to resart to load a new java war file so I usually browse on other tabs while the server is restarting. when it starts, the notification window pops to the top. Perhaps there should be an option to turn this on or off (the option could default to off)...I don't really see that many people putting really important information into a javascript notification window anyway.

Re:Oh my Gosh...

Wanna guess how long Mozilla, Firefox and such will take to fix this?

And how long IE will take?

Didn't think so. :)