mailing list archives
Re: Is Mozilla's "patch" enough?
From: Thomas Kaschwig <thomas () kaschwig net>
Date: Mon, 12 Jul 2004 16:01:53 +0200
Aviv Raff wrote:
If an attacker has a file writing access to the user's default profile
directory, or somehow manages to update/create the file user.js (or
even worse - mozilla.cfg) he can override the patch's configuration
change, and enable the shell protocol handler again.
Nobody should have write access to your user profile. If someone is able
to modify your user.js file, (s)he can enable some worse options, e.g.
the protocol handler for `hcp' or `vbscript', but this is not a security
flaw of mozilla...
PGP/GnuPG: http://www.kaschwig.net/kaschwig.gpg.asc * KeyID: 0x3D68D63A
Fingerprint: 274A 4CB8 B362 D593 39D6 0989 8FC3 725F 3D68 D63A
Full-Disclosure - We believe in it.