full-disclosure - Re: Firefox 2.0.0.6 Remote Variable Leakage vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0708121958270.22574@dione>
Date: Sun, 12 Aug 2007 20:36:18 +0200 (CEST)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: carl hardwick <hardwick.carl@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Firefox 2.0.0.6 Remote Variable Leakage
 vulnerability

On Sun, 12 Aug 2007, carl hardwick wrote:

> Firefox Remote Variable Leakage

I'm afraid don't entirely follow this attack - though I might be wrong...

The PoC, in essence, enumerates all Javascript variables and functions
that are publicly declared by the browser in the context of the current
page (after loading several chrome:// scripts in the security context of
the current page to inflate their count [1]).

Yes, there's plenty of variables and functions defined, but to consider
this a security vulnerability, one should demonstrate that:

  1) Sensitive user preferences are disclosed this way (for example, any
     non-trivial prefs.js setting),

  2) Variables set by other sites can be read in violation of same-domain
     policy.

Is this the case here?

[1] What I find troubling in your example is that chrome:// URLs are not
restricted on Internet-originating SCRIPT SRC=. I'm not sure there's any
sensitive data in Firefox chrome:// namespace, but it is certainly unwise
to assume this will always be the case for third-party plugins.

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/