1. Been infected with spyware? Tell us about your problem.
2. Protect your PC from viruses, spyware.
3. For fast automatic spyware removal, try CounterSpy, SUPERAntiSpyware

Found vulnerability in the Firefox built-in popup blocker

This vulnerability, coupled with an additional trick, allows the attacker to read arbitrary user-accessible files on the system, and thus steal some fairly sensitive information.

Vulnerable Systems: Firefox version 1.5.0.9

For security reasons, Firefox does not allow Internet-originating websites to access the file:// namespace. When the user chooses to manually allow a blocked popup however, normal URL permission checks are bypassed. The attacker may fool the browser to parse a chosen HTML document stored on the local filesystem, and because Firefox security manager treats all file:/// URLs as having “same origin”, such a document could read other local files at its discretion with the use of XMLHttpRequest, and relay that information to a remote server.

For protect your PC, upgrade Firefox to Firefox 2.0

Read more: Firefox Popup Blocker Allows Reading Arbitrary Local Files

February 7, 2007 on 5:33 am | In Exploits & Vulnerabilities | |
Submit to: Digg | SlashDot | Del.icio.us

No Comments yet »

RSS feed for comments on this post. TrackBack URI

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

This is a captcha-picture. It is used to prevent mass-access by robots. (see: www.captcha.net)

You must read and type the 4 chars within 0..9 and A..F, and submit the form.

  

Oh no, I cannot read this. Please, generate a


MY ANTI SPYWARE Powered by WordPress with Pool theme design by Borja Fernandez.
Entries and comments feeds. Valid XHTML and CSS. ^Top^