Slashdot Mirror

← Back to Stories (view on slashdot.org)

Gaping Holes In Fully Patched IE7, Firefox 2

Posted by kdawson on from the just-when-you-thought-it-was-safe dept.

Continent1106 writes "Hacker Michal Zalewski has ratcheted up his ongoing assault on Web browser security models, releasing details on serious flaws in fully patched versions of IE6, IE7 and Firefox 2.0. The vulnerabilities could cause cookie stealing, page hijacking, memory corruption, code execution, and URL bar spoofing attacks." Here is Zalewski's post to Full Disclosure.

17 of 303 comments (clear)

  1. Ah well by GFree · · Score: 5, Informative

    Gaping Holes In Fully Patched IE7, Firefox 2
    In other words, it doesn't matter which browser you use, you're gonna get F'd in the A regardless? Sounds painful.
    1. Re:Ah well by rts008 · · Score: 5, Informative

      RTFA...Try the demo's...It will reduce the FUD.

      I tried the demo page/file and got no response whatever.

      "2) Title : Firefox Cross-site IFRAME hijacking (MAJOR)
            Impact : keyboard snooping, content spoofing, etc
            Demo : http://lcamtuf.coredump.cx/ifsnatch/
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=38268 6 [May 30]"
      from:(http://lcamtuf.coredump.cx/ifsnatch/) which is from:2) Title : Firefox Cross-site IFRAME hijacking (MAJOR)
            Impact : keyboard snooping, content spoofing, etc
            Demo : http://lcamtuf.coredump.cx/ifsnatch/
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=38268 6 [May 30]"

      and this:"3) Title : Firefox file prompt delay bypass (MEDIUM)
            Impact : non-consentual download or execution of files
            Demo : http://lcamtuf.coredump.cx/ffclick2/
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=37647 3 [Apr 04]"

      I tried both link's test button and got no response whatever.

      IMHO, this must be something related to running Windows, as my Kubuntu 7.04 Feisty w/ Firefox 2.0.04 (with NoScript, Adblock, Adblock Filterset, and Flashblock) just does not act on this.

      I guess I need to install some version of Windows to experience this...I feel deprived and left out!

      Does this work with Firefox w/ NoScript on Windows?

      From past experience, I have no doubts that it works with any version of IE on any Windows platform.

      --
      Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
    2. Re:Ah well by Kelson · · Score: 5, Funny

      I use wget.

      You have not truly experienced the web until you have experienced it using telnet to port 80.

  2. Victim Statistics? by Anonymous Coward · · Score: 5, Insightful

    Perhaps I'm ignorant, but does anyone ever find themselves a victim of these "gaping holes"? I can't say as I've ever browsed on to a site and found myself the victim of a compromised computer or ended up with viruses. Is there a site/blog that reports such statistics?

  3. Gaping holes? by Paktu · · Score: 5, Funny

    Article tagged as goatse.

  4. Didn't learn lesson from javascript by mrcaseyj · · Score: 5, Insightful
    They said they could make javascript secure but it's still a huge source of holes. Instead of learning our lesson, Flash, another executable web format is taking over. Don't use flash because it's cool. Only use it if you really need it for your web page.


    And if Ubuntu was really concerned about security they would ship it by default with a web browser already set up under a separate username with strict selinux policies.

  5. alternatives by sudo · · Score: 5, Insightful

    Well there's always Opera?

  6. Sounds like Terrorist to me. by 3seas · · Score: 5, Funny

    cookie STEALING, page HIJACKING, memory CORRUPTION, code EXECUTION, and URL bar spoofing ATTACKS.

    So where the fuck is home land security when you need them.

    1. Re:Sounds like Terrorist to me. by Anonymous Coward · · Score: 5, Funny

      what's so terrible about urls?

  7. Go old NoScript by Nutsquasher · · Score: 5, Insightful

    Keeps all of that Firefox JavaScript nastiness at bay, plus flash ads to boot. :)

  8. AND LYNX! by Anonymous Coward · · Score: 5, Funny

    No holes for Lynx? Oh well...
    (sits back with biggest grin on face)

  9. Slashdot responses by Frankie70 · · Score: 5, Insightful

    1) If Article Posted about IE security bugs
        - Regular mudfest, everyone throwing mud on Microsoft
    & IE. Everyone saying I have FF/Linux/Safari whatever,
    so I am safe. Nobody talks about changing settings,
    disabling javascript or Activex as a good workaround.

    2) If Article Posted about FF security bugs
        - Lot of workarounds posted - disable Javascript,
    get some plugin, change some settings, don't go to
    the website etc. How great that the it is open source,
    someone will fix the bug in one hour & release patch.
    Bugs are avenues to show how great open source is.

    Now both are posted together, let's collate responses
    at the end of the day

  10. Re:But in order to be affected... by snowraver1 · · Score: 5, Informative

    It's called a Man-in-the-middle attack. Say you go to google.ca (I'm Canadian) It goes something like this:

    You> Yo DNS server, I wanna Talk to google.

    DNS> Roger that! Go to 72.14.253.103.

    You> Yo 72.14.253.103 Whacha got?

    72.14.253.103>Index.html

    You> Looks like Index.html says I need the google picture.

    Eve (Eve is sitting at the same coffee shop as you. Eve is bad)> Ahem, err, sir, I have this envelope for you. It's from google. It contains your picture. *Sniker*. (You don't notice the snicker)

    You> OH N0E$! TH3 P1CtUr3 us3d a buff3r ov3rflow vuln3rab1lity and n0w you have a virus that mak3s you typ3 lik3 a n00b!

    For more information look here: http://en.wikipedia.org/wiki/Man_in_the_middle_att ack

    --
    Copyright 2010. All rights reserved. This comment may not be copied in any way including, but not limited to caching.
  11. Are you sure? by kybred · · Score: 5, Insightful
    I can't say as I've ever browsed on to a site and found myself the victim of a compromised computer or ended up with viruses that I know of.

    There, fixed that for you.

  12. Re:But in order to be affected... by Bob+of+Dole · · Score: 5, Interesting
    Don't be so sure that avoiding "shady" sites will protect you.
    I run a few perfectly un-shady sites (an imageboard, a specialized search engine, and a funny images repository), but recently some users started complaining about the popups that were trying to install spyware.
    I don't have any popups on my sites! (I don't even use target="_new"!) but still users were getting spyware popups. The popups were so evil that the only way to avoid getting redirected to the spyware site was to disable javascript (Even in firefox. in IE it just installed the spyware automatically, but firefox at least you had to click "download". Still, it made my site unusable)

    I went into my advertisers control panel, checked for anything remotely shady. Nothing. I tried turning off all third party advertisers (like doubleclick), figuring maybe one of them was redirecting users. Nope, some users still got popups. Worst of all, I NEVER got the popup, no matter what browser I was using.

    It turns out it's cause I'm an American. The advertiser had specified that the advert with the embedded redirect only show up in every country except America. That stopped me from seeing it on the site, but what about the control panel? I could see all the ads there, even the ones not targeted at my location. Here's what they did in actionscript: (pseudocode)

    if getTimeZone() in EUROPE_TIMEZONES:
        redirectToSpyware()
    else:
        displayHarmlessAdvert()

    So even when I checked the ads in the control panel they looked fine.

    My point is, don't think there's a scary corner of the internet where all the spyware/exploits hang out. The bastards making this crap know that most people don't go to those kinds of places, so they'll do anything they can to sneak their crap onto legitimate sites. (MySpace got hit with one of these a few months back, I think)
    --
    I respond to your sigs
  13. Re:But in order to be affected... by beyondkaoru · · Score: 5, Insightful

    ok, i'm not a web developer so i wouldn't know, but is there any way to force your advertisers (malicious or otherwise) to not use javascript/flash/whatever? since it's essentially running code we don't trust on the client's computer...

    essentially, do the noscript thing on your own servers, or host ads (i assume they're mostly just pictures with links) on your own servers somehow.

    --
    the privacy of one's mind is important.
    you do have something to hide.
  14. No holes? by Kelson · · Score: 5, Funny

    No holes for Opera?

    Are you serious? Have you looked at that icon? There's a huge hole right in the middle, and no one seems to acknowledge it!