New Firefox cookie vulnerability, workaround
Posted by Percy Cabello on February 15th, 2007 • Tags:
ShareThis

Zalewski’s websiteSecurity researcher/hacker, Michal Zalewski has released a report on a security vulnerability affecting Firefox 2.0.0.1 and possibly earlier versions. The vulnerability could allow a malicious web site to impersonate an authentic one and set a cookie on its behalf. This could be used to perform cross-window and cross-frame attacks compromising personal information exchanged via Ajax. Zalewski has released a test case that demonstrate the vulnerability.

It has already been filed to Bugzilla for its resolution. In the meantime, Zalewski recommends this workaround:

  • Enter about:config in the location bar to access Firefox’s advanced preferences
  • Right click on any preference and select New>String
  • Enter capability.policy.default.Location.hostname.set for the preference name
  • Enter noAccess for the preference value
  • Restart Firefox

It’s still unknown if this will be fixed in upcoming 2.0.0.2 (due by the end of February) but it’s most likely it won’t. You can read the original report here.

Comments
Firefox 2.0.0.1 安全漏洞 at Gea-Suan Lin’s BLOG said on February 15, 2007, 5:49 pm:

[...] Firefox 2.0.0.1 因為對 DOM 的處理不當造成 Cookie 外漏以及其他的安全漏洞：New Firefox cookie vulnerability, workaround，Bug Report 在 Bugzilla@Mozilla 的 Zalewski cookie setting / same-domain bypass [...]

ericsk’s blog » Firefox 2.0.0.1 的安全漏洞 said on February 15, 2007, 8:22 pm:

[...] Firefox 2.0.0.1 被發現有安全上的漏洞：New Firefox cookie vulnerability, workaround，以及 Bug report：Zalewski cookie setting / same-domain bypass [...]

JS said on February 16, 2007, 7:41 pm:

I have added this item in about:config and used the test site to see if it worked. Says I’m ok but I cannot see it in about:config. Does it hide itself, can it be removed if its proved troublesome?

Thanks
JS

JS said on February 16, 2007, 8:04 pm:

Also if I add it to Prefs.js with Firefox closed firefox removes the line when I launch it. Is NoScript doing this?

Percy Cabello said on February 16, 2007, 8:40 pm:

I noticed that the new preference is not listed in about:config after adding it during my tests but forgot to mentioned it in the article. However I see it in my prefs.js file and I could remove it from there at any time if necessary.

Haven’t tried it with NoScript installed though.

幻想的世界 said on February 17, 2007, 1:07 am:

Firefox 2.0.0.1 安全性漏洞

今天在 Mozilla Taiwan 討論區 發現了這個漏洞的消息。這漏洞主要是因為對 DOM ( Document Object Model ) çš„ “location.hostname” 屬性的處理不當，以致於惡意的網站，有機會可以取得其他網站的 Co…