stuff » mozilla http://blog.beford.org Tue, 18 Oct 2011 11:33:49 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Firefox 3.6.19 Remote Code Execution http://blog.beford.org/2011/04/15/firefox-3-6-19-remote-code-execution/ http://blog.beford.org/2011/04/15/firefox-3-6-19-remote-code-execution/#comments Fri, 15 Apr 2011 06:32:08 +0000 Fernando M http://blog.beford.org/?p=176

To be disclosed soon.

 

]]> http://blog.beford.org/2011/04/15/firefox-3-6-19-remote-code-execution/feed/ 0 Firefox 2.0.0.10 released http://blog.beford.org/2007/11/27/firefox-20010-released/ http://blog.beford.org/2007/11/27/firefox-20010-released/#comments Tue, 27 Nov 2007 05:40:52 +0000 Fernando M http://blog.beford.org/?p=11 Continue reading →]]> Mozilla Corporation just released Firefox 2.0.0.10 which includes fixes against JAR uri attacks. This issue affected browsers that used Gecko engine, a quick check showed me that only K-meleon browser was also updated, however there are several Gecko based web browsers that need to get fixed: Gecko-based browsers.

Update: Let’s make that, Firefox 2.0.0.11, which also fixes some regressions.

]]> http://blog.beford.org/2007/11/27/firefox-20010-released/feed/ 0 Firefox jar: Protocol Vulnerability http://blog.beford.org/2007/11/10/firefox-jar-protocol-vulnerability/ http://blog.beford.org/2007/11/10/firefox-jar-protocol-vulnerability/#comments Sat, 10 Nov 2007 10:47:45 +0000 Fernando M http://blog.beford.org/?p=8 Continue reading →]]> I just came across pdp’s finding jar protocol vulnerability on Mozilla Firefox, I think its a big issue, and the fact that it has been on bugzilla (#369814) for way more than ten fuck*ng days is not a good thing.

According to pdp, this issue makes vulnerable to Cross-site scripting applications that allow users uploading compressed ZIP, and JAR files. After a couple of minutes messing around the poc’s, I figured out that sites with open redirect issues are vulnerable too. I’ve created this poc that attacks Gmail, it’s based on my previous post and it will only show your contacts list, it’s not being logged server side or anything (as some people thought that my previous poc did. Credit to tx for discovering the open redirect issue used to exploit Google / Firefox):

http://beford.org/stuff/jarjarbinks.htm

Who’s fault? Both, Google for having open redirect issues and not fixing them, and Mozilla Corporation for failing to address this problem.

What can I do to protect myself? Giorgio Maone have already added protection against this flaw to NoScript development version.

Update: NoScript released stable version with Jar protection. A new bugzilla (#403331) entry was created to fix the inappropiate redirect on jar protocol, according to the lastest comments and bug keyword, there seems to be a patch and will be availible with Firefox 2.0.0.10.

]]> http://blog.beford.org/2007/11/10/firefox-jar-protocol-vulnerability/feed/ 21