| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <022701c53080$54acb900$4a00030a@netvision.ads> Date: Thu Mar 24 14:47:10 2005 From: mikx at mikx.de (mikx) Subject: Firescrolling 2 [Firefox 1.0.1] __Summary Even though Firefox 1.0.1 patched one of the key bugs behind my firescrolling exploit (the ability of plugins to load chrome files in a hidden frame) the ability to hijack a drag and drop operation and open a privileged xul file is still available. The demo opens "chrome://global/content/alerts/alert.xul" when dragging the scrollbar the first time. This XUL file automaticly runs an inline script to turn the window into a tray notification alert. This demo is just an example of an annoying usage, but if the browser or an extension contains an inline script that uses an eval/setTimeout with a parameter an attacker can influence it turns into an arbitrary code execution bug. Also update or uninstall scripts could be a valuable target. I doubt most extension developers think about problems that could occure if a XUL file in their extensions is opened directly. __Proof-of-Concept http://www.mikx.de/firescrolling2/ __Status The bug is fixed in Firefox 1.0.2. 2005-03-09 Vendor informed (bugzilla.mozilla.org #285438) 2005-03-11 Vendor confirmed bug 2005-03-23 Vendor published fixed version and advisory 2005-03-24 Public disclosure The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0401 to this issue. __Affected Software Tested with Firefox 1.0.1 __Contact Informations Michael Krax <mikx@...x.de> http://www.mikx.de/?p=12 mikx
Powered by blists - more mailing lists