Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Is Mozilla's "patch" enough?
From: William Warren <hescominsoon () emmanuelcomputerconsulting com>
Date: Mon, 12 Jul 2004 09:47:19 -0400

the mozilla developers ar already seriously considering changing to whitelisting in the next release

Pavel Kankovsky wrote:

On Mon, 12 Jul 2004, Aviv Raff wrote:

As you may already know the Mozilla's "patch" for the shell protocol
security issue is merely a global configuration change. But is it

No. As someone has already pointed out, Mozilla should whitelist safe
external protocols rather than blacklist unsafe external protocols.

If an attacker has a file writing access to the user's default profile
directory, or somehow manages to update/create the file user.js (or
even worse - mozilla.cfg) he can override the patch's configuration
change, and enable the shell protocol handler again.

The user has already lost. Game over.

An attacker can exploit the ability to modify the user's configuration in
many different ways. E.g. redirect the browser to a proxy under the
attacker's control, make Mozilla use a trojanized Chrome or a trojanized
Java plugin, etc.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

My "Foundation" verse:
Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou shalt condemn. This is the heritage of the servants of the LORD, and their righteousness is of me, saith the LORD.

-- carpe ductum -- "Grab the tape"

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]