Attachment 41643 Details for Bug 88509

mfsa2005-48

mfsa2005-48.html (text/html), 2.63 KB, created by Wolfgang Rosenauer on 2005-07-12 10:33:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Wolfgang Rosenauer

Created: 2005-07-12 10:33:36 UTC

Size: 2.63 KB

patch

obsolete

><html>
>  <head>
>    <title>MFSA 2005-48: Same-origin violation with InstallTrigger callback</title>
>    <style>
>       .label { width: 8em; font-weight: bold; float: left;}
>    </style>
>  </head>
><body>
><h1>Mozilla Foundation Security Advisory 2005-48</h1>
>
><span class="label">Title:</span>      Same-origin violation with InstallTrigger callback<br>
><span class="label">Severity:</span>   Low (High for Suite)<br>
><span class="label">Reporter:</span>   Matthew Mastracci<br>
><span class="label">Products:</span>   Firefox, Mozilla Suite<br>
><br>
><span class="label">Fixed in:</span>   Firefox 1.0.5<br>
><span class="label">&nbsp;</span>      Mozilla Suite 1.7.9<br>
>
><h3>Description</h3>
>
>The InstallTrigger.install() method for launching an install accepts a
>callback function that will be called with the final success or error status.
>By forcing a page navigation immediately after calling the install method
>this callback function can end up running in the context of the new page
>selected by the attacker. This is true even if the user cancels the unwanted
>install dialog: cancel is an error status. This callback script can steal
>data from the new page such as cookies or passwords, or perform actions on
>the user's behalf such as make a purchase if the user is already logged
>into the target site.
><p>
>In Firefox the default settings allow only http://addons.mozilla.org to
>bring up this install dialog. This could only be exploited if users have
>added questionable sites to the install whitelist, and if a malicious site
>can convince you to install from their site that's a much more powerful
>attack vector.
><p>
>In the Mozilla Suite the whitelist feature is turned off by default, any site
>can prompt the user to install software and exploit this vulnerability.
><p>
>The browser has been fixed to clear any pending callback function when switching
>to a new site.
>
>
><h3>Workaround</h3>
>
>Firefox: Remove untrustworthy sites from the list of those allowed to install,
>or turn off software installation entirely.
><ol>
><li>Open the Options dialog from the Tools menu
><li>Select the Web Features icon in the left panel
><li>Uncheck the "Allow web sites to install software" box, or click the
>    "allowed sites" button on that line to remove untrusted sites.
></ol>
><p>
>Mozilla Suite: Turn off the software installation feature.
><ol>
><li>Open the Preferences dialog from the Edit menu
><li>Select "Software Installation" in the "Advanced" group in
>    the left panel.
><li>Uncheck the "Enable software installation" checkbox.
></ol>
>
>
><h3>References</h3>
>
><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=293331">
>https://bugzilla.mozilla.org/show_bug.cgi?id=293331</a><br>
>
></body>
></html>

<html>
  <head>
    <title>MFSA 2005-48: Same-origin violation with InstallTrigger callback</title>
    <style>
       .label { width: 8em; font-weight: bold; float: left;}
    </style>
  </head>
<body>
<h1>Mozilla Foundation Security Advisory 2005-48</h1>

<span class="label">Title:</span>      Same-origin violation with InstallTrigger callback<br>
<span class="label">Severity:</span>   Low (High for Suite)<br>
<span class="label">Reporter:</span>   Matthew Mastracci<br>
<span class="label">Products:</span>   Firefox, Mozilla Suite<br>
<br>
<span class="label">Fixed in:</span>   Firefox 1.0.5<br>
<span class="label">&nbsp;</span>      Mozilla Suite 1.7.9<br>

<h3>Description</h3>

The InstallTrigger.install() method for launching an install accepts a
callback function that will be called with the final success or error status.
By forcing a page navigation immediately after calling the install method
this callback function can end up running in the context of the new page
selected by the attacker. This is true even if the user cancels the unwanted
install dialog: cancel is an error status. This callback script can steal
data from the new page such as cookies or passwords, or perform actions on
the user's behalf such as make a purchase if the user is already logged
into the target site.
<p>
In Firefox the default settings allow only http://addons.mozilla.org to
bring up this install dialog. This could only be exploited if users have
added questionable sites to the install whitelist, and if a malicious site
can convince you to install from their site that's a much more powerful
attack vector.
<p>
In the Mozilla Suite the whitelist feature is turned off by default, any site
can prompt the user to install software and exploit this vulnerability.
<p>
The browser has been fixed to clear any pending callback function when switching
to a new site.


<h3>Workaround</h3>

Firefox: Remove untrustworthy sites from the list of those allowed to install,
or turn off software installation entirely.
<ol>
<li>Open the Options dialog from the Tools menu
<li>Select the Web Features icon in the left panel
<li>Uncheck the "Allow web sites to install software" box, or click the
    "allowed sites" button on that line to remove untrusted sites.
</ol>
<p>
Mozilla Suite: Turn off the software installation feature.
<ol>
<li>Open the Preferences dialog from the Edit menu
<li>Select "Software Installation" in the "Advanced" group in
    the left panel.
<li>Uncheck the "Enable software installation" checkbox.
</ol>


<h3>References</h3>

<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=293331">
https://bugzilla.mozilla.org/show_bug.cgi?id=293331</a><br>

</body>
</html>

Actions: View

Attachments on bug 88509: 41640 | 41641 | 41642 | 41643 | 41644 | 41645 | 41646 | 41647 | 41648 | 41649 | 41650 | 41651