30th july- latest internet browser vulnerability news.

Discussion in 'other security issues & news' started by nadirah, Jul 30, 2004.

Thread Status:
Not open for further replies.
  1. nadirah

    nadirah Registered Member

    Oct 14, 2003
    Mozilla / Mozilla Firefox User Interface Spoofing Vulnerability
    Secunia Advisory: SA12188http://secunia.com/gfx/printer.jpg Release Date: 2004-07-30
    Critical: http://secunia.com/gfx/crit_3.gif
    Moderately critical Impact: Spoofing
    Where : From remote

    Software:Mozilla 0.x
    Mozilla 1.0
    Mozilla 1.1
    Mozilla 1.2
    Mozilla 1.3
    Mozilla 1.4
    Mozilla 1.5
    Mozilla 1.6
    Mozilla 1.7.x
    Mozilla Firefox 0.x

    Choose a product and view comprehensive vulnerability statistics and all Secunia advisories affecting it.
    A vulnerability has been reported in Mozilla and Mozilla Firefox, allowing malicious websites to spoof the user interface.

    The problem is that Mozilla and Mozilla Firefox don't restrict websites from including arbitrary, remote XUL (XML User Interface Language) files. This can be exploited to "hijack" most of the user interface (including tool bars, SSL certificate dialogs, address bar and more), thereby controlling almost anything the user sees.

    The Mozilla user interface is built using XUL files.

    A PoC (Proof of Concept) exploit for Mozilla Firefox has been published. The PoC spoofs a SSL secured PayPal website.

    This has been confirmed using Mozilla 1.7 for Linux, Mozilla Firefox 0.9.1 for Linux, Mozilla 1.7.1 for Windows and Mozilla Firefox 0.9.2 for Windows. Prior versions may also be affected.

    NOTE: This issue appears to be the same as Mozilla Bug 244965.

    Do not follow links from untrusted sites.

    Provided and/or discovered by:
    Reported in Mozilla Firefox by:
    Jérôme ATHIAS (also created a PoC)

    Reported in Mozilla by:
    James Ross

    2004-07-30: Added an additional Mozilla Bug reference.

    Original Advisory:
    Original Advisory and Proof of Concept:

    Other References:
    XUL Documentation:

    Mozilla Bug reference:

    Mozilla Bug reference:

    Please note: The information, which this Secunia Advisory is based upon, comes from third party unless stated otherwise.

    Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  2. Justhelping

    Justhelping Guest

    Ah a fellow Singaporean.

    http://forums.mozillazine.org/viewtopic.php?t=102334 is another good discussion on this fairly old issue. Some solutions are presented. You would have to do some "Scary" configuration changes. To wit

    user_pref("dom.disable_window_open_feature.close", true);
    user_pref("dom.disable_window_open_feature.directories", true);
    user_pref("dom.disable_window_open_feature.location", true);
    user_pref("dom.disable_window_open_feature.menubar", true);
    user_pref("dom.disable_window_open_feature.minimizable", true);
    user_pref("dom.disable_window_open_feature.personalbar", true);
    user_pref("dom.disable_window_open_feature.resizable", true);
    user_pref("dom.disable_window_open_feature.scrollbars", true);
    user_pref("dom.disable_window_open_feature.titlebar", true);
    user_pref("dom.disable_window_open_feature.toolbar", true);
  3. nadirah

    nadirah Registered Member

    Oct 14, 2003
    I am just a 13 year old boy from Singapore, Justhelping.
  4. Justhelping

    Justhelping Guest

    I know you are 13 years old. (or at least between 13 to 16 from your postings).

    It's rare to see someone from Asia much less Singapore. The last time there was such a poll, I recall only 2 people from Asia.
  5. nadirah

    nadirah Registered Member

    Oct 14, 2003
    Why don't you register and be a member so we can get to know each other? Are u a computer pro?
  6. Justhelping

    Justhelping Guest

    I'm already registered.

    As for being a "pro", I'm no more a pro than you, I suspect.
Thread Status:
Not open for further replies.