full-disclosure - Is Mozilla's "patch" enough?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040712143154.1A79.0@argo.troja.mff.cuni.cz>
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: Is Mozilla's "patch" enough?

On Mon, 12 Jul 2004, Aviv Raff wrote:

> As you may already know the Mozilla's "patch" for the shell protocol
> security issue is merely a global configuration change. But is it
> enough?

No. As someone has already pointed out, Mozilla should whitelist safe
external protocols rather than blacklist unsafe external protocols.

> If an attacker has a file writing access to the user's default profile
> directory, or somehow manages to update/create the file user.js (or
> even worse - mozilla.cfg) he can override the patch's configuration
> change, and enable the shell protocol handler again.

The user has already lost. Game over.

An attacker can exploit the ability to modify the user's configuration in
many different ways. E.g. redirect the browser to a proxy under the
attacker's control, make Mozilla use a trojanized Chrome or a trojanized
Java plugin, etc.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."