![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Mozilla Mozilla](http://a.fsdn.com/sd/topics/mozilla_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
Vulnerability In Firefox Popup Blocker 100
cj writes in with news of a vulnerability in Firefox's stock popup blocker discovered by Michal Zalewski. The vulnerability can allow a malicious user to read files from an affected system. The attacker would "need to plant a predictably named file with exploit code on the target system. This sounds hard, but isn't," according to the article.
Anyone knows if the 2.x tree is vulnerable too? (Score:5, Informative)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
http://wiki.mozilla.org/Major_Update_1.5.0.x_to_2. 0.0.x [mozilla.org]
Re: (Score:1)
Re: (Score:2, Funny)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
From grandparent when i ran dapper though i found it easy to download and install firefox 2 off the official site
Bullshit apparently now means "I agree with you."
Re: (Score:3, Funny)
Re: (Score:2)
Re:Anyone knows if the 2.x tree is vulnerable too? (Score:4, Informative)
Fedora has no plans to officially release a 2.0 for FC6:
http://fedoraproject.org/wiki/Firefox2 [fedoraproject.org]
"Fedora users will be to stay with Firefox 1.5 and wait for the Firefox 3.0 update"
That's left me a bit annoyed personally... I like the changes to FF2...
Re: (Score:3, Informative)
Re: (Score:2)
Back when FC4 was current, I got fed up with waiting for updates for FF from fedora, and even more fed up with broken updates for FF. So I uninstalled the FC release of Firefox, and downloaded a copy direct from the FF homepage. It has worked well, and been auto-updating without incident ever since.
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.1) Gecko/20061208 Firefox/2.0.0.1
On a tangent, why does the headline not say "Vulnerability in Win32 Fir
Re:Anyone knows if the 2.x tree is vulnerable too? (Score:4, Informative)
Re: (Score:2)
Then I went and grabbed FF Portable & just unzipped it into a folder.
http://portableapps.com/apps/internet/firefox_por
There's an installer, but you can just unzip the
Note: The actual FF executable is a folder or two deep
Re: (Score:1)
Re: (Score:2)
the upgrade pusher will not work for some, and neither should it
Re: (Score:1)
Re:Anyone knows if the 2.x tree is vulnerable too? (Score:5, Insightful)
Nope, because no example exploit is given and the means of exploitation looks rather unlikely:
"To create a popup warning, a script embedded on the page calls: window.open('file:///c:/windows/temp/xxxxxxx.htm'
with a name calculated by repeating a procedure implemented in SetUpTempFile() with a seed calculated by the server based on reported system time (p2.html?time)."
1. It assumes that the temp file is c:/windows/temp. It isn't, unless you're running Windows 95, and only then if you've not changed it from default. That's the *system* default temp file. The *user* temp directory is inside local settings in the user specific area (much harder to find out remotely. Maybe not impossible, but you'd have to get lucky (it's not just the username as the directory name.. it has things like
2. Calculating the seed to that accuracy is damned hard.
Re: (Score:2, Interesting)
Firefox sometimes creates outright deterministic temporary filenames in system-wide temporary directory when opening files with external applications
And according to him, calculating the seed isn't terribly difficult. srand() is called directly before the random file creation and is seeded with the current time, in milliseconds. That time is possible to obtain within a narrow margin using JavaScript.
Re: (Score:3, Interesting)
Although a bug exists (file:// bypasses some of the security checks.. fixed already apparently) the theoretical exploit as written isn't usable - probably why there's no working e
Re: (Score:1)
I strongly doubt it does, because you'd fall foul of vista UAC protection
How does that matter? It's not as if anybody is using Vista yet... :)
On a serious note, is the system temp directory really not world-writeable in Vista?
<rant>Also, what's with Windows never deleting anything in the user temp directories? What part of temporary does it not understand? Every now and then I'll see an app crap itself because it can't create a temporary file... because the directory is full!. What the **** is up with that?! I've still got files in my user temp folder from when the m
Re:Anyone knows if the 2.x tree is vulnerable too? (Score:4, Interesting)
Re: (Score:1)
Windows does clean it... well, sort of.
When you're running low of disk space a warning appears, offering to run the Disk Cleanup tool [microsoft.com], which tries to remove unused temporary files (among other things).
But I wonder why it doesn't erase those pesky thumbs.db files (by checking their last access date).
Re:Anyone knows if the 2.x tree is vulnerable too? (Score:4, Insightful)
Windows is slightly worse, but not by a lot.
Re: (Score:1)
Re: (Score:2)
$
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
By "many" do you perhaps mean "none"?
There's always the odd floppy or CD-based mini distro, but that's really not relevant.
I just checked my Slackware machine's init scripts. It clears /tmp/.X11 lock files, but that's it.
*Ahem*
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
I've always liked MZ way of thinking. I've read his book. Usually his discoverings do not cover the mass side of a thing. He usually focuses on targeted attacks which are hard but possible - I mean attacks when you target some individual or organisation to get data, not when you want to have biggest coverage of zombies on casual-home-user-machines.
Same as in here. If you are a security professional (I can guess - I am
Re: (Score:2)
Clearly targeting a specific user where you knew information like the username and system setup beforehand would make this possible (independent of OS).
Re: (Score:2)
> needs fixing, but the way it's presented is as if there's a
> general exploit, but it just isn't that easy.
You mean how it is presented here (on Slashdot). Well you must be new here.
Re: (Score:1)
Re: (Score:2)
I just checked whether I could get the provided code to run at all, file:/// or http:/// [http] popup or not, nothing worked XMLHttpRequest.open() is not allowed in any scenario (including directed at external sites). That being said, I did manage to get the popup to display a file:/// url, so maybe there is some vulnerability there. But for my setup the exploit code doesn't do anything.
Re: (Score:2, Informative)
Re: (Score:1)
Re: (Score:2)
I notice that Netscape 9 for linux [netscape.com]
Right... (Score:4, Informative)
I was refering to ewl1217's post... (Score:1)
Re:Right... (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:1)
oops...
Seems I've just entered the unintentionally-trollish-joke-taken-for-a-troll camp. The original (ok, cryptic) meaning of my post was that this exploit is lame-ass - open source should be, apparently, so we're told by some, catching up with proprietory - and yet this is the best style of exploit it can come up with? It's crap!
Oh well. Suddenly I see the thrill of trolling. The pull of the dark side is strong. [mumble mumble hot grits mumble Natelie Portman mumble mumble overlords mumble mod me down
Re: (Score:2)
Oblig. (Score:2)
Windows only? (Score:5, Informative)
"When the user chooses to manually allow a blocked popup however, normal URL permission checks are bypassed. "
So you have to MANUALLY disable the popup blocker on a site you don't know in order to make this work. Also, the article keeps talking about c:\whatever. It does not indicate if this is a vulnerability in a non-Windows system.
Re:Windows only? (Score:5, Informative)
Re: (Score:1)
Re:Windows only? (Score:5, Funny)
That is the lamest vulnerability post I have seen in a long time...really stretching here are we not?
Re: (Score:3, Funny)
Lamest. Vulnerability-post. Ever. (Score:3, Insightful)
Linux can still be secure (Score:2)
Even before levels were added, there used to be SE Linux systems on the net with public root passwords. (one Gentoo, and one either Debian or Red Hat) You could log in as root, look around a tad, append a message to a file, run a few processes... and that was about it. You couldn't load drivers, reboot, read log files, install
Re: (Score:2)
nope, UID was 0 (Score:2)
I couldn't even write to files that were world-writable, owned by root or not.
Do an "ls -Z" on a default Fedora install to see what is going on. Fedora can be nearly like the system described if you install the "strict" policy.
To admin the system, you need to change roles. No single role can do everything, and many role-to-role transitions are prohibited.
Re: (Score:2)
so how exactly were theese boxes administered?
unless there is an admin there with physical access who doesn't mind doing a
Re: (Score:2)
So there is NOT an administrative login that lets you do everything. There are numerous limited-capability administrative logins, sort of. They are not related to UID.
First you'd log in as root, since the old UID-based system is still being enforced. You'd need to do this from the console to get put into a role which is able to transition to something interesting. Then you run th
Re: (Score:2)
so what you are saying is that while the people have the root password the box has been configured in such a way that a root login from remote isn't really root.
which is ok if the admin has local acess to the machine but renders the system pretty useless otherwise.
Re: (Score:1)
Re: (Score:1)
I tried with /etc/passwd (Score:1)
Fixed (Score:5, Informative)
Re: (Score:2)
bullshit (Score:2, Troll)
This exploit requires you to download the exploit code then, click on a link with file:/// with CTRL down (to turn off popup blocking). Sounds less like an exploit of firefox and more of the stupid user who runs things.
Tom
Re: (Score:2)
Re: (Score:2)
Oh good! So the most it can do is wipe out all your data!
I sure do hope you're not a security consultant...
Re: (Score:2)
Also, this is why we backup data.
Tom
Re: (Score:3, Insightful)
This vulnerability involves the "Show blocked popup" feature, which you can activate from the status bar icon indicating that a popup was blocked. If the popup is allowed in the first place, the security check works correctly.
Wow... (Score:1)
Only 6% of my visitors are using 1.5x. (Score:2, Informative)
Whew! (Score:1)