stuff » mozilla http://blog.beford.org Fri, 13 Aug 2010 22:59:52 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 Firefox 2.0.0.10 released http://blog.beford.org/2007/11/27/firefox-20010-released/ http://blog.beford.org/2007/11/27/firefox-20010-released/#comments Tue, 27 Nov 2007 05:40:52 +0000 Fernando http://blog.beford.org/?p=11 Continue reading →]]> Mozilla Corporation just released Firefox 2.0.0.10 which includes fixes against JAR uri attacks. This issue affected browsers that used Gecko engine, a quick check showed me that only K-meleon browser was also updated, however there are several Gecko based web browsers that need to get fixed: Gecko-based browsers.

Update: Let's make that, Firefox 2.0.0.11, which also fixes some regressions.

]]> http://blog.beford.org/2007/11/27/firefox-20010-released/feed/ 0 Firefox jar: Protocol Vulnerability http://blog.beford.org/2007/11/10/firefox-jar-protocol-vulnerability/ http://blog.beford.org/2007/11/10/firefox-jar-protocol-vulnerability/#comments Sat, 10 Nov 2007 10:47:45 +0000 Fernando http://blog.beford.org/?p=8 Continue reading →]]> I just came across pdp's finding jar protocol vulnerability on Mozilla Firefox, I think its a big issue, and the fact that it has been on bugzilla (#369814) for way more than ten fuck*ng days is not a good thing.

According to pdp, this issue makes vulnerable to Cross-site scripting applications that allow users uploading compressed ZIP, and JAR files. After a couple of minutes messing around the poc's, I figured out that sites with open redirect issues are vulnerable too. I've created this poc that attacks Gmail, it's based on my previous post and it will only show your contacts list, it's not being logged server side or anything (as some people thought that my previous poc did. Credit to tx for discovering the open redirect issue used to exploit Google / Firefox):

http://beford.org/stuff/jarjarbinks.htm

Who's fault? Both, Google for having open redirect issues and not fixing them, and Mozilla Corporation for failing to address this problem.

What can I do to protect myself? Giorgio Maone have already added protection against this flaw to NoScript development version.

Update: NoScript released stable version with Jar protection. A new bugzilla (#403331) entry was created to fix the inappropiate redirect on jar protocol, according to the lastest comments and bug keyword, there seems to be a patch and will be availible with Firefox 2.0.0.10.

]]> http://blog.beford.org/2007/11/10/firefox-jar-protocol-vulnerability/feed/ 21