bugtraq - [SCL-2005.002] - IDN Feature Workaround via proxy.pac

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4876153C00898F43B189AF95F84BCE14263C3A@usilms28.ca.com>
Date: Tue, 8 Feb 2005 12:39:59 -0500
From: "Scovetta, Michael V" <Michael.Scovetta@...com>
To: <bugtraq@...urityfocus.com>, <vuln-dev@...urityfocus.com>,
	<webappsec@...urityfocus.com>
Subject: [SCL-2005.002] - IDN Feature Workaround via proxy.pac

=====[BEGIN-SCL-REPORT]=====

________________________________________________________________________

                   Scovetta Labs Security Advisory

 Title:         IDN Feature Workaround via proxy.pac
 Status:        Public
 Release Date:  2005-02-08
________________________________________________________________________

 Package:       Web Browsers
 Vendor:        Mozilla - http://www.mozilla.org
                Opera - http://www.opera.com
                Others (non-IE)
 Priority:      High
 Vulnerability: IDN Allows Domain Spoofing

Affected Versions:
==================

 Firefox 1.0 is vulnerable
 Most other modern browsers (except IE) have been reported vulnerable

Background: (from official advisory [1])
===========

 International Domain Name [IDN] support in modern browsers allows 
 attackers to spoof domain name URLs + SSL certs.

Description:
============

 See description [1].

Exploit:
========

 See exploit [1].

Work-around:
============

 A browser-level fix for this vulnerability is to create a proxy.pac
 (auto-configuration) file, containing the following text:

function FindProxyForURL(url, host){
  // valid characters, add more as you find you need them
  var validChars = "abcdefghijklmnopqrstuvwxyz0123456789.-";
  for (i=0; i<host.length; i++) {
    if (validChars.indexOf(host[i]) == -1) {
      alert('Invalid character(s) in host name.');
      return "PROXY 127.0.0.1:9999";
    }
  }
}

See [3] for the full file.

Vendor Response:
================

 See vendor response [1]

Revision History
================

2005-02-08: Public Release [2]

Credits:
========

 Discovery of the vulnerability to Eric Johanson (ericj@...oo.com).
 Proxy.pac workaround to Michael Scovetta (security@...vettalabs.com

References:
==========

 [1] http://www.shmoo.com/idn/homograph.txt
 [2] http://www.scovettalabs.com/advisory/SCL-2005.002.txt
 [3] http://www.scovettalabs.com/download/IDNproxy.pac

Disclaimer
==========

 The content of this report is purely informational and meant only 
 for the purpose of education and protection. Scovetta Labs and 
 Michael Scovetta shall in no event be liable for any damage 
 whatsoever, direct or implied, arising from use or spread of this 
 information. All identifiers (hostnames, IP addresses, company names, 
 individual names etc.) used in examples and demonstrations are used 
 only for explanatory purposes and have no connection with any real 
 host, company or individual. In no event should it be assumed that 
 use of these names means specific hosts, companies or individuals 
 are vulnerable to any attacks nor does it mean that they consent to 
 being used in any vulnerability tests. The use of information in 
 this report is entirely at user's risk.

Copyright
=========

 (c) 2005 Michael Scovetta. Forwarding and publishing of this document 
 is permitted providing the content between "[BEGIN-SCL-REPORT]" and
 [END-SCL-REPORT]" marks remains unchanged.

=====[END-SCL-REPORT]=====