bugtraq - Firefox security bug (proxy-bypass) in current Tor BBs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <N1-McgQk1-2r_@Safe-mail.net>
Date: Thu, 3 May 2012 00:35:18 -0400
From: oLhrrBHQeTr0EmbKwBXa@...e-mail.net
To: bugtraq@...urityfocus.com
Subject: Firefox security bug (proxy-bypass) in current Tor BBs

https://blog.torproject.org/blog/firefox-security-bug-proxy-bypass-current-tbbs

"A user has discovered a severe security bug in Firefox related to websockets bypassing the SOCKS proxy DNS configuration. This means when connecting to a websocket service, your Firefox will query your local DNS resolver, rather than only communicating through its proxy (Tor) as it is configured to do. This bug is present in current Tor Browser Bundles (2.2.35-9 on Windows; 2.2.35-10 on MacOS and Linux).

To fix this dns leak/security hole, follow these steps:

    Type “about:config” (without the quotes) into the Firefox URL bar. Press Enter.
    Type “websocket” (again, without the quotes) into the search bar that appears below "about:config".
    Double-click on “network.websocket.enabled”. That line should now show “false” in the ‘Value’ column.

See Tor bug 5741 for more details.
(https://bugs.torproject.org/5741)
We are currently working on new bundles with a better fix."

- http://pastebin.com/xajsbiyh

----------------------------
Anonymous comments:
----------------------------
On May 2nd, 2012 Anonymous said:

Oh dear :(

Does anyone know if IP addresses leaked to Twitter when (through NoScript) I enabled javascript for that site?

If yes, I may be in trouble.
----------------------------
On May 2nd, 2012 Anonymous said:

@anon, AFAIK Twitter does not use web sockets, so even if you enabled Javascript on Twitter it should not be an issue. I could be wrong or there could be other issues.
----------------------------
On May 2nd, 2012 Anonymous said:

Theoretically, an exit node can embed a websocket into your traffic stream if you are using HTTP.
----------------------------
On May 2nd, 2012 Anonymous said:

As long as you weren't doing anything illegal in the United States you should be fine. Tor has never been about hiding illegal activity. And since Twitter is in the US and doesn't respond to foreign court orders… well…
----------------------------
On May 2nd, 2012 Anonymous said:

Ah right, maybe Anonymous "Oh dear" is a fucking communist, or even a dirty whistle blower like Maning! Brave, law abide citizens haven't got anything, that must be hidden, so maybe you want to forbid TOR, Mr. McCarthy?
----------------------------
On May 2nd, 2012 Anonymous said:

Oh great, so all my Pastebins are belong to the Feds?
----------------------------

THE DRAMA CONTINUES...

TBB proxy bypass: Some DNS requests not going through Tor
Ticket #5741 (closed defect: fixed)
https://trac.torproject.org/projects/tor/ticket/5741

"This is not the first time some rarely triggered bug in Firefox causes Tor to be bypassed, and certainly will not be the last one. Since these bugs have a very high security impact I propose they are guarded against. How about running Firefox inside some kind of firewall that drops all network packets not going to Tor?"
----------------------------
Comments:
----------------------------
by mikeperry

Good catch Robert. Disabling about:config pref network.websocket.enabled prevents it from happening for me... I'm now grepping through the Firefox WebSocket code looking for the issue..

----------------------------
by mikeperry

This is fixed and pushed to all TBB branches. I fixed it by blocking all DNS requests while socks_remote_dns is enabled, so we don't end up with this showing up in new components in the future.

Interested folks can review the patch here:  https://gitweb.torproject.org/torbrowser.git/blob/maint-2.2:/src/current-patches/firefox/0018-Prevent-WebSocket-DNS-leak.patch
----------------------------
Additional Reference:

[tor-talk] Firefox security bug (proxy-bypass) in current TBBs

Robert Ransom rransom.8774 at gmail.com
Wed May 2 22:43:52 UTC 2012

See https://blog.torproject.org/blog/firefox-security-bug-proxy-bypass-current-tbbs
for the security advisory.

Robert Ransom

https://lists.torproject.org/pipermail/tor-talk/2012-May/024123.html
----------------------------
Another version of TBB, another bug. IMO, they should mark all releases of TBB as ALPHA!

At the time of this bug report collection and passing the news onto others, there have not been any new release of TBB versions to fix this bug on their download pages, but it'll come.