full-disclosure - Is Mozilla's "patch" enough?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200407121651.15163.sec@kaschwig.net>
From: sec at kaschwig.net (Thomas Kaschwig)
Subject: Is Mozilla's "patch" enough?

Aviv Raff wrote:

> How can it not be a security flaw of mozilla if a setting in the
> user.js overrides the global security setting defined by a patch, and
> any manual setting defined by the user through the about:config?

Because *nobody* should be able to write to your user.js file. If someone 
has write access to other peoples ~/.bashrc or whatever and inserts some 
malicious code, it is also no security flaw of the bash.

> I understand that if an attacker has the ability to change the user.js

If you can find a way to modify mozilla's preferences remotly, /then/ this 
is really a problem.

> file he can do worse things, but why should there be a way to override
> security patches without uninstalling them?

You can overwrite every security patch, if you have sufficient write 
permissions.

Thomas
-- 
PGP/GnuPG: http://www.kaschwig.net/kaschwig.gpg.asc * KeyID: 0x3D68D63A
Fingerprint: 274A 4CB8 B362 D593 39D6 0989 8FC3 725F 3D68 D63A