full-disclosure - Is Mozilla's "patch" enough?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8beca820407120508439bd91c@mail.gmail.com>
From: avivra at gmail.com (Aviv Raff)
Subject: Is Mozilla's "patch" enough?

As you may already know the Mozilla's "patch" for the shell protocol
security issue is merely a global configuration change. But is it
enough?

If an attacker has a file writing access to the user's default profile
directory, or somehow manages to update/create the file user.js (or
even worse - mozilla.cfg) he can override the patch's configuration
change, and enable the shell protocol handler again.

Trying to apply the patch again won't override the attacker's
configuration change, and doing it manually through the about:config
interface will be enough only until the user closes the browser.

Tested on Mozilla Firefox 0.9.1.

What do you think?