Slashdot Mirror

← Back to Stories (view on slashdot.org)

Vulnerability In Firefox Popup Blocker

Posted by kdawson on from the all-your-files dept.

cj writes in with news of a vulnerability in Firefox's stock popup blocker discovered by Michal Zalewski. The vulnerability can allow a malicious user to read files from an affected system. The attacker would "need to plant a predictably named file with exploit code on the target system. This sounds hard, but isn't," according to the article.

5 of 100 comments (clear)

  1. Re:Anyone knows if the 2.x tree is vulnerable too? by Tony+Hoyle · · Score: 2, Interesting

    Is anyone still running 1.5.0? I thought the auto upgrade had handled that months ago.

  2. Re:Anyone knows if the 2.x tree is vulnerable too? by N7DR · · Score: 2, Interesting
    FYI, the auto-update to 2.0.x has been delayed a few times. It will happen sometime soon.

    http://wiki.mozilla.org/Major_Update_1.5.0.x_to_2. 0.0.x

  3. Re:Anyone knows if the 2.x tree is vulnerable too? by iago-vL · · Score: 2, Interesting
    For what it's worth, from Zalewski's original post,

    Firefox sometimes creates outright deterministic temporary filenames in system-wide temporary directory when opening files with external applications

    And according to him, calculating the seed isn't terribly difficult. srand() is called directly before the random file creation and is seeded with the current time, in milliseconds. That time is possible to obtain within a narrow margin using JavaScript.

    --
    http://www.skullsecurity.org/blog/
  4. Re:Anyone knows if the 2.x tree is vulnerable too? by Tony+Hoyle · · Score: 2, Interesting

    I strongly doubt it does, because you'd fall foul of vista UAC protection - no user app should go near the systemwide temp directory (that's even if you can find it... %TEMP%, GetTempFileName, etc. will always give you the user one. AFAIK you have to dig into the registry to find the system one, or be running as a system service).

    Although a bug exists (file:// bypasses some of the security checks.. fixed already apparently) the theoretical exploit as written isn't usable - probably why there's no working example

  5. Re:Anyone knows if the 2.x tree is vulnerable too? by Carnildo · · Score: 3, Interesting

    Thanks for the tip. I just checked my temp directory, and I've got stuff dating back to early 2001 in there.

    --
    "They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.