Full Disclosure mailing list archives
Re: Is Mozilla's "patch" enough?
From: Pavel Kankovsky <peak () argo troja mff cuni cz>
Date: Mon, 12 Jul 2004 14:51:14 +0200 (MET DST)
On Mon, 12 Jul 2004, Aviv Raff wrote:
As you may already know the Mozilla's "patch" for the shell protocol security issue is merely a global configuration change. But is it enough?
No. As someone has already pointed out, Mozilla should whitelist safe external protocols rather than blacklist unsafe external protocols.
If an attacker has a file writing access to the user's default profile directory, or somehow manages to update/create the file user.js (or even worse - mozilla.cfg) he can override the patch's configuration change, and enable the shell protocol handler again.
The user has already lost. Game over. An attacker can exploit the ability to modify the user's configuration in many different ways. E.g. redirect the browser to a proxy under the attacker's control, make Mozilla use a trojanized Chrome or a trojanized Java plugin, etc. --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms ] "Resistance is futile. Open your source code and prepare for assimilation." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Is Mozilla's "patch" enough? Aviv Raff (Jul 12)
- Re: Is Mozilla's "patch" enough? Pavel Kankovsky (Jul 12)
- Re: Is Mozilla's "patch" enough? William Warren (Jul 12)
- Re: Is Mozilla's "patch" enough? Thomas Kaschwig (Jul 12)
- Re: Is Mozilla's "patch" enough? Barry Fitzgerald (Jul 12)
- Re: Is Mozilla's "patch" enough? William Warren (Jul 12)
- Re: Is Mozilla's "patch" enough? Thomas Kaschwig (Jul 13)
- Re: Is Mozilla's "patch" enough? Aviv Raff (Jul 12)
- Re: Is Mozilla's "patch" enough? Georgi Guninski (Jul 12)
- Re: Is Mozilla's "patch" enough? Aviv Raff (Jul 12)
- Re: Is Mozilla's "patch" enough? Florian Weimer (Jul 12)
- Re: Is Mozilla's "patch" enough? Aviv Raff (Jul 12)
- Re: Is Mozilla's "patch" enough? Florian Weimer (Jul 12)
- Re: Is Mozilla's "patch" enough? Aviv Raff (Jul 12)
- Re: Is Mozilla's "patch" enough? Pavel Kankovsky (Jul 12)