Tab Browser VUlnerablilities - Tilted Forum Project Discussion Community

kifferfong · 10-21-2004, 10:04 PM

Including Firefox :/ :

http://techrepublic.com.com/5100-22_...ml?tag=nl.e019

Let's hope the actual 1.0 release for Firefox comes out soon (it's only Preview Release 1.0 now)

theFez · 10-21-2004, 10:14 PM

text of story:

Quote:

Major browsers bitten by security bugs

October 21, 2004

Takeaway:
What do Internet Explorer, Mozilla's browsers, and Opera all have in common? Bugs.

Stay on top of the latest tech news with our free IT News Digest newsletter, delivered each weekday. Automatically sign up today!

By Robert Lemos
Staff Writer, CNET News.com

For every browser, a security bug.

That seemed to be Wednesday's lesson from security information provider Secunia for the developers of the major Internet browsers. The company released information on two common security issues with the tabbed browsing feature found in several flavors of the Mozilla Foundation's browsers, the Opera browser, the Konqueror browser for Linux and two third-party plug-ins that add the feature to Microsoft's Internet Explorer.

One flaw would let a malicious Web site that's open in one tabbed window have access to the information typed into another tabbed window. The other flaw lets a malicious Web site open a dialog box that seems to originate from a site displayed in a different browser tab.

"I think the issue is that they didn't consider the consequences of having all the browser tabs in one application window," said Thomas Kristensen, chief technology officer for Secunia. "That is what fooled them."

More IT news stories
Google fixes security hole
Online intrusion risks large identity cache
FBI supplier readies secure Linux
Ballmer: We need a $100 PC

Secunia recommends that Web surfers using the tabbed feature should disable JavaScript or simply avoid visiting trusted Web sites when an untrusted Web site is open in one of the browser tabs.

The KDE Project fixed the flaws in the latest version of Konqueror, which was released Tuesday. Chris Hoffman, director of engineering for the Mozilla Foundation, said the flaws should be fixed in Firefox by the time Firefox 1.0 ships, in the next couple weeks. Opera could not immediately be reached for comment.

Microsoft's browser is also prey to two more-serious flaws found by another security researcher, who's known as "Http-equiv." The first flaw expands on a drag-and-drop vulnerability found by the researcher in August. That flaw could be used to place HTML code on the victim's computer.

According to Secunia's advisory, the second, more-serious flaw can bypass the security mechanisms put in place by Microsoft's Windows XP Service Pack 2, an update released in August that hardens the protections around the XP operating system. The latest update released this month also does not prevent an attacker from taking advantage of the flaw. The vulnerability lets an attacker execute HTML documents on the user's computer.

The two vulnerabilities, when used together, let malicious Web sites place and run code on a visitor's computer. The vulnerabilities are not completely new; they're a twist on the older vulnerabilities, Http-equiv said in an e-mail.

"It's simple, yet complicated--pretty difficult (to do), I might add," he said.

Echoing Http-equiv's assessment, Microsoft said that using the flaws for an attack would not be easy.

"Early reports indicate that significant user action is required to execute this attack," the software giant said in a statement. "An attacker would need to first entice the user to visit a specific Web site and then entice the user to take a series of specific actions on the Web site, then reboot or log off before the attack could succeed."

The company was not aware of any customers whose PCs had been compromised by the vulnerabilities.

The fact that the flaws found on Internet Explorer are more serious than the other browser vulnerabilities is par for the course, Secunia's Kristensen said.

"The impact of vulnerabilities in Internet Explorer is quite significant when compared to other browsers," he said. "The (tabbed browsing vulnerabilities) are flaws, and they are serious, and they should be fixed, but you aren't going to have your entire system compromised by them."

Yet, Http-equiv stressed that such vulnerabilities are becoming harder to find.

"The lockdown of the local zone is Microsoft's saving grace," Http-equiv said. "Anything (such as the vulnerabilities) there on in from SP2 is going to be one-off oddities." In Windows XP Service Pack 2, Microsoft added more stringent security to prevent outside programs from running unchecked on a user's machine, also known as the "local zone."

(passage highlighted by me)

what i love about open source: bug annouced wednesday, fix announced friday.

The article mentions a 1.0 release of firefox in the next couple weeks, sweet.

kifferfong · 10-21-2004, 11:04 PM

Yep! Firefox 1.0 comes out on November 9, with a lot of hype and excitement. Check outhttp://www.spreadfirefox.com/ ^_^

Almo · 10-21-2004, 11:23 PM

I have firefox installed and never bothered to use it regularly. I guess I'll have to update to 1.0. The reason I installed it was for mouse gestures but that stopped working after a day or so, and I never touched it since then. Hopefully the new version is a bit friendlier to these third-party plugins.

redwhorns · 10-23-2004, 08:15 AM

remember it's not only firefox but also opera and other browsers!

jonjon42 · 10-23-2004, 09:39 AM

the fix should already be in cvs I believe it was submitted wed. or thursday
so if any of you guys use nightly builds please check for this vulnerability again :-D

10-21-2004, 10:04 PM	#1 (permalink)
kifferfong Tilted Location: Kuala Lumpur, Malaysia	Tab Browser VUlnerablilities Including Firefox :/ : http://techrepublic.com.com/5100-22_...ml?tag=nl.e019 Let's hope the actual 1.0 release for Firefox comes out soon (it's only Preview Release 1.0 now)

10-23-2004, 09:39 AM	#6 (permalink)
jonjon42 Psycho Location: inside my own mind	the fix should already be in cvs I believe it was submitted wed. or thursday so if any of you guys use nightly builds please check for this vulnerability again :-D __________________ A damn dirty hippie without the dirty part....

10-21-2004, 11:04 PM	#3 (permalink)
kifferfong Tilted Location: Kuala Lumpur, Malaysia	Yep! Firefox 1.0 comes out on November 9, with a lot of hype and excitement. Check outhttp://www.spreadfirefox.com/ ^_^

10-21-2004, 11:23 PM	#4 (permalink)
Almo Tilted	I have firefox installed and never bothered to use it regularly. I guess I'll have to update to 1.0. The reason I installed it was for mouse gestures but that stopped working after a day or so, and I never touched it since then. Hopefully the new version is a bit friendlier to these third-party plugins.

10-23-2004, 08:15 AM	#5 (permalink)
redwhorns Upright	remember it's not only firefox but also opera and other browsers!