Mozilla / Mozilla Firefox Frame Injection Vulnerability

[ronjor]

-{ Quote: "A seven year old vulnerability has been re-introduced in Mozilla and Firefox, which can be exploited by malicious people to spoof the contents of web sites" }-
Secunia (http://secunia.com/advisories/15601/)

[snowbound]

Nice....

I tried the test anyway and FF flunked....


snowbound

[ronjor]

Snowbound

Do you have a screenshot of the flunking?

Scratch that. I got it too.

[Jeremy2]

FF is vulnerable, only if the links open in a new window, otherwise it's not, i.e: links open in a new tab. So, this maybe taken as a workaround.

So, the vulnerability doesn't work if the links open in a new tab.

[gottadoit]

Same thing found here, I have everything forced to open in tabs and my FF passed....

[Mrkvonic]

Hi,

Excuse my ignorance. How do you force everything to open in tabs?
I edited about:config and changed showsinglewindow to true, but the test still opens a new window.
Suggestions?

I found it:

browser.link.open_newwindow set to 3 instead of 2, this will open in tabs.
browser.link.open_external set to 3 instead of 2, this will open in tabs.

One more edit:

I tried this also on another computer that I have proxomitron installed and without the above configuration. Proxo discovered the exploit and removed it. Hooah!

Cheers,
Mrk

[blabhead]

-{ Quote: "

I found it:

browser.link.open_newwindow set to 3 instead of 2, this will open in tabs.
browser.link.open_external set to 3 instead of 2, this will open in tabs.

" }-
it works for me
Thank You