Bugtraq mailing list archives
Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability
From: Daniel Veditz <dveditz () cruzio com>
Date: Thu, 22 Feb 2007 17:23:13 -0800
pdp (architect) wrote:
However, here is an interesting thought for you: instead of asking the user into bookmarking a page you can supply the bookmark directly to their browser by using Live Bookmarks. So, a mainstream attack will be when a SPLOG network injects malicious links into their feeds. If someone happens to be subscribed to this network with a Live Bookmark and they click on it... well you know. I haven't tested this, although it should work.
It doesn't work -- thankfully we thought of that back when we implemented Live Bookmarks in Firefox 1.0
Current thread:
- Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Daniel Veditz (Feb 23)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Michal Zalewski (Feb 22)
- Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability pdp (architect) (Feb 22)