lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <40F29667.2080206@emmanuelcomputerconsulting.com>
From: hescominsoon at emmanuelcomputerconsulting.com (William Warren)
Subject: Is Mozilla's "patch" enough?

the mozilla developers ar already seriously considering changing 
to whitelisting in the next release

Pavel Kankovsky wrote:

> On Mon, 12 Jul 2004, Aviv Raff wrote:
> 
> 
>>As you may already know the Mozilla's "patch" for the shell protocol
>>security issue is merely a global configuration change. But is it
>>enough?
> 
> 
> No. As someone has already pointed out, Mozilla should whitelist safe
> external protocols rather than blacklist unsafe external protocols.
> 
> 
>>If an attacker has a file writing access to the user's default profile
>>directory, or somehow manages to update/create the file user.js (or
>>even worse - mozilla.cfg) he can override the patch's configuration
>>change, and enable the shell protocol handler again.
> 
> 
> The user has already lost. Game over.
> 
> An attacker can exploit the ability to modify the user's configuration in
> many different ways. E.g. redirect the browser to a proxy under the
> attacker's control, make Mozilla use a trojanized Chrome or a trojanized
> Java plugin, etc.
> 
> --Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
> "Resistance is futile. Open your source code and prepare for assimilation."
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

-- 
My "Foundation" verse:
Isa 54:17  No weapon that is formed against thee shall prosper; 
and every tongue that shall rise against thee in judgment thou 
shalt condemn. This is the heritage of the servants of the LORD, 
and their righteousness is of me, saith the LORD.

-- carpe ductum -- "Grab the tape"


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ