New Vulnerability Affects All Browsers

Jimmy writes "Secunia is reported about a new vulnerability, which affects all browsers. It allows a malicious web site to "hi-jack" pop-up windows, which could have been opened by e.g. a your bank or an online shop. Here is a demonstration of the vulnerability"

Comments

Re:Sniff, our little browser's all grown up...

[Indy Media Watch]

Now we can move from the myth that free software is impervious to exploits

Uh, who was saying that?

Here's how it works

[sbszine]

The links to Citibank from the Secunia site are actually handled by JavaScript. The script sets a timer, then opens citibank. Every second or so, Secunia's script then checks whether you've opened Citibank's pop-up. If you have, it opens a window with the same name (i.e. variable name) as Citibank's window, thus overwriting their content.

So the attacker doesn't need you to click on anything, they just need you to have their site open -- with the timer going -- in another window. Also, the attacker needs to know in advance what name the victim site's pop-up is referenced by. A dynamically generated name could possibly defeat this attack, though the attacker could always crawl the DOM for a handle to the pop-up.

Of course it's a bug

[Chuck Chunder]

Target names should only exist within the namespace of the site that created them.

Site A should be able to create and interact with a window named "popup".
Site B should be able to create and interact with a window named "popup".
This should happen without either site interfering, blocking or overwriting the other. They should simply be invisible to each other, existing in completely seperate little worlds.

Re:Of course it's a bug

[Anonymous Coward]

OF course that seems sensible. But when you say "should" do you mean "should" because you think so, or because some W3C or other standard says so?