Slashdot Mirror

← Back to Stories (view on slashdot.org)

Big Day For Browser Vulnerabilities

Posted by timothy on from the uh-oh dept.

An anonymous reader writes "All browsers have been reported vulnerable to different vulnerabilities today. Starting with: Internet Explorer on XP SP1/SP2, which suffers a new system compromise (of course) vulnerability. Continuing with: Opera, Mozilla / Mozilla Firefox / Camino, Safari, Netscape, Konqueror, Avant Browser and Maxthon, which all suffers some new spoofing vulnerabilitities. Demonstrations of the spoofing vulnerabilities are available here and here."

10 of 429 comments (clear)

  1. It's a clever one. by jimicus · · Score: 5, Interesting

    For those who can't be bothered to RTFA, the Mozilla vulnerability is essentially a standard link with an "onMouseOver" bit which runs a little piece of JavaScript.

    The JavaScript pauses for a few seconds (while you presumably get distracted by another page) then flashes up a "Please enter some text" dialogue box.

    A similar effect could be achieved by calling the JavaScript on pretty much any event; the vulnerability relies on it being unclear which site caused the dialogue box to pop up. I can see how it could be classed a vulnerability, but it's hardly earth shattering.

    1. Re:It's a clever one. by stromthurman · · Score: 2, Interesting

      I do agree that in most cases the lack of displayed text would be noticed in a matter of moments. I noticed it right away. However, if we're talking about usernames and passwords, enough info might be retrieved to be damaging. For instance, when I'm logging on to gmail, the username field has the focus, so I imediately begin typing that, hit a tab and start with the password, I could get through a fair portion of my password before realizing that the fields don't have the proper focus. Now, for well chosen passwords, that might not be so damning. But when people use the word "password" for a password, one should be careful.
      I would not go as far as to say this is a critical vulnerability, the createPopup() function in IE was far more damning, but I would consider it something that should be addressed. Even if it's not a critical issue, it does violate certain design principles/visual metaphors (if I can borrow a term Tufte seems to love), in that if a given view is not active, it's components should not have the focus of the keyboard, or any other input device.

      --
      I have discovered a truly remarkable sig which this margin is too small to contain.
  2. Re:I wonder by Anonymous Coward · · Score: 1, Interesting

    Why was the parent comment modded a troll? This will be an interesting race to watch.

  3. Re:Been thinking about this... by CXI · · Score: 5, Interesting

    I would be more in favor of a tab not opening a dialog or firing any other events until it becomes active again. Allowing tabs to gain focus without user intervention has the potential to be annoying as hell. For example, an ad on a page could keep popping that tab to the front for you to see it. Ugh.

  4. I'm not in the book WHOOOAAAAAA... Ugh! by tepples · · Score: 2, Interesting

    Everyone doesn't use gopher???

    He's not in the book, you know.

  5. The form vulnerability... by swiftstream · · Score: 2, Interesting

    I've noticed the form vulnerability many times before--many email sites seem to do this, so that if I go to, say, hotmail.com and then open a new tab to go to google for a search, I start typing into the hotmail user name box.

    I never thought of it as anything more than an annoyance, though... I wonder how many other little annoyances there are hiding around that may actually have security implications?

    --
    Be a PATRIOT--because the only thing we have to fear is the lack thereof.
  6. Re:It's interesting to compare these by Anonymous Coward · · Score: 1, Interesting

    Why don't they just change the browser so that a dialog popup from tab X will only be seen when tab X is active.
    That way if tab Y is active it will always be "on top" of anything X does. When I switch to tab X I see all the dialogs on top of the webpage.

  7. Browser windows must become hierarchical by Animats · · Score: 2, Interesting
    Browser windows are going to have to become hierarchical. If the code in window A causes the opening of window B, window B must be considered a child of window A. If window A closes, so must window B.

    This means popups can't survive their parents, which is probably a good thing.

    Visual parenting is needed, too. If the parent window is minimized or goes to the back, so should its child windows. Window headers should reflect the parent window's header.

    Child windows shouldn't be allowed to position themselves entirely outside of the parent window. They should have to overlap, at least marginally. (Strict users might turn on a mode where they have to overlap totally, like subwindows in an application.) This creates a visual association between the parent and child windows.

    With this, multiple window sites behave in a more tolerable manner.

  8. Konqueror vulnerable, really? by Balinares · · Score: 2, Interesting

    I tested the spoof vulnerability in Konqueror 3.3.1 (the latest).

    When displaying the popup, it 1) switched back to the tab that owns it, and 2) the popup clearly contained the server name "secunia.com".

    I was about to call this unhealthy sensationalism, but I haven't checked out older versions. Can anyone confirm the vulnerability in 3.3.0 and older? Thanks.

    --

    -- B.
    This sig does in fact not have the property it claims not to have.
  9. Re:This is why we need CHROOT browsers by Anonymous Coward · · Score: 1, Interesting

    I would use chroot for server processes that allow access to internet clients, but I wouldn't worry about client software running under user priveleges.

    Client apps should be secure by default. Even if they are not, if some user's system gets compromised because they visit a malicious website who's fault is that?

    Users should be educated not to play around on the 'net. Its dangerous. If they don't know what they are doing they should ask for assistance from their local sys admin. These systems are expensive tools, not toys to be ignorantly played with. There are many legal and security related concerns with general usage of these devices. If the user doesn't fully understand these issues they should be monitored.