Slashdot Mirror
Vulnerability In Firefox Popup Blocker
cj writes in with news of a vulnerability in Firefox's stock popup blocker discovered by Michal Zalewski. The vulnerability can allow a malicious user to read files from an affected system. The attacker would "need to plant a predictably named file with exploit code on the target system. This sounds hard, but isn't," according to the article.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
This only affects the 1.5.x branch, not the current 2.x stuff...
That was quite possibly the most ignorant statement I have read on slashdot recently. I'm not particularly partial to either Firefox or IE, but exploit for exploit, your statement has no merit. What will be the deciding factor will be how fast it is patched.
From the fine article:
"When the user chooses to manually allow a blocked popup however, normal URL permission checks are bypassed. "
So you have to MANUALLY disable the popup blocker on a site you don't know in order to make this work. Also, the article keeps talking about c:\whatever. It does not indicate if this is a vulnerability in a non-Windows system.
I didn't make it clear that the start of my post was directed at ewl1217's post above my own.
So you think IE is secure?
Enjoy your virii.
Great Intellect...
Enjoy your virii.
You mean viruses. http://en.wikipedia.org/wiki/Virii
No result back with either FF1.5.0.9 and FF 2.0.0.1 using remote page. Local works obviously.
Already fixed: https://bugzilla.mozilla.org/show_bug.cgi?id=36942 7
You have said about three things, and totally failed to link any of them together.
# cat
Damn, my RAM is full of llamas.
This just shows why open source just isn't ready for the desktop.
Oh fer chrissake! Did you even read the article? It's a very unlikely set of circumstances, on one specific flavor of Windows, difficult to even demonstrate and it will be patched before any exploits "in the wild". Hardly yet another lame-ass exploit.
On the other hand, Windows has been demonstrating why closed source isn't ready for the desktop for the last 10 years! with every week bringing yet another lame-ass exploit, discovered "in the wild" and unpatched for months.
Get back to work, Microsoftie, and fix them damned Vista bugs!
oops...
Seems I've just entered the unintentionally-trollish-joke-taken-for-a-troll camp. The original (ok, cryptic) meaning of my post was that this exploit is lame-ass - open source should be, apparently, so we're told by some, catching up with proprietory - and yet this is the best style of exploit it can come up with? It's crap!
Oh well. Suddenly I see the thrill of trolling. The pull of the dark side is strong. [mumble mumble hot grits mumble Natelie Portman mumble mumble overlords mumble mod me down but mumble mumble]
Anyway, Windows is dead. Netcraft confirms it.
Is crushing a suspect's child's testicles illegal?
John Yoo: "No, [if] the President thinks he needs to do that."
Firefox/mozilla/etc run as your user. At most this would be able to infect my user, not the system. Even in windows, if you don't run as root it should be the same deal.
This exploit requires you to download the exploit code then, click on a link with file:/// with CTRL down (to turn off popup blocking). Sounds less like an exploit of firefox and more of the stupid user who runs things.
Tom
Someday, I'll have a real sig.
That's wrong. This bug affects both 2.0 and 2.0.0.1. This confusion seems to stem from the version field in the bug, which is set to the earliest version that's affected.
Gavin Sharp
there's always going to be one security vulnerability with Firefox (and most all other software)... stupid users.
unfortunately there will never be a patch for it (what's that saying about building a better idiot?)
you mean the *other* browser has holes too?
Parent post looks like it is written in English, but it does not parse.
"Humor. It is a difficult concept. It is not logical." --Lt. Saavik
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
Glad to hear that the current 2.x stuff is not affected. I'm using FF 2.0.0.1 now, in my knoppix remaster (see screenshots below), and have other things I need to be doing with the remaster than upgrading FF. I do, however, jump on it and upgrade the browsers whenever they have new versions out. With Firefox, I put 9 RSS feeds on the toolbar by default, and for it's home page, I use a local version of this one, but with a slide-out ~/ menu setup, for browsing the /ramdisk.
I notice that Netscape 9 for linux may be released in a couple of months. I'll try it out. Since I usually run my knoppix remaster with a 1 or 2 GB "persistent home" partition, I can easily download it and have it up and running in a few minutes, and can keep it around for a while to see how it does compared to Flock, Firefox and Opera. If it has anything to offer, and is not loaded up with AOL stuff, I might put it in the CD. I still use Netscape 4 on a Macintosh Quadra 660AV, and it seems to do a better job with the web pages than icab 2.99.
That version is free, with no time limit, since it is for older Mac systems. Downloads quickly and installs automatically, however. Just a little disappointed in how many of the web pages look, so I tend to stick with Netscape.
Rapidweather
Rapidweather's Linux Screenshots.
If you have SE Linux running with a strict policy, it just doesn't matter if they do log in as root. They'd have to get into the correct role and level as well, which would be blocked.
Even before levels were added, there used to be SE Linux systems on the net with public root passwords. (one Gentoo, and one either Debian or Red Hat) You could log in as root, look around a tad, append a message to a file, run a few processes... and that was about it. You couldn't load drivers, reboot, read log files, install software, etc. SE Linux locked the system down good and hard.
Only 6% of my users so far this year are using Firefox 1.5x compared to 68% using Firefox 2.0. There are still about 4% of users who are using IE 6 without service pack 2 on XP (or are using IE6 on older versions of Windows). Point: it's a vulnerability that hackers won't bother to exploit and Mozilla will probably patch quickly anyway.
- John
http://www.jabcreations.com/
Good thing I'm using the Internet Explorer.
w00t
Here's a solution, since it is open-source go into the code and fix it yourself, or are you too stupid to even exist let alone use a computer? If you are that stupid then go slit your fucking wrists right now fucktard to take yourself out of the gene pool.
The UID really was zero, which is NOT a regular user account. It's a normal root account.
I couldn't even write to files that were world-writable, owned by root or not.
Do an "ls -Z" on a default Fedora install to see what is going on. Fedora can be nearly like the system described if you install the "strict" policy.
To admin the system, you need to change roles. No single role can do everything, and many role-to-role transitions are prohibited.