Loading ...New Firefox cookie vulnerability, workaround
Published: February 15th, 2007
Security researcher/hacker, Michal Zalewski has released a report on a security vulnerability affecting Firefox 2.0.0.1 and possibly earlier versions. The vulnerability could allow a malicious web site to impersonate an authentic one and set a cookie on its behalf. This could be used to perform cross-window and cross-frame attacks compromising personal information exchanged via Ajax. Zalewski has released a test case that demonstrate the vulnerability.
It has already been filed to Bugzilla for its resolution. In the meantime, Zalewski recommends this workaround:
- Enter about:config in the location bar to access Firefox’s advanced preferences
- Right click on any preference and select New>String
- Enter capability.policy.default.Location.hostname.set for the preference name
- Enter noAccess for the preference value
- Restart Firefox
It’s still unknown if this will be fixed in upcoming 2.0.0.2 (due by the end of February) but it’s most likely it won’t. You can read the original report here.
You can leave a response, or trackback from your own site.
Subscribe RSS
Subscribe email
February 16th, 2007 at 7:41 pm
I have added this item in about:config and used the test site to see if it worked. Says I’m ok but I cannot see it in about:config. Does it hide itself, can it be removed if its proved troublesome?
Thanks
JS
[Reply]
February 16th, 2007 at 8:04 pm
Also if I add it to Prefs.js with Firefox closed firefox removes the line when I launch it. Is NoScript doing this?
[Reply]
February 16th, 2007 at 8:40 pm
I noticed that the new preference is not listed in about:config after adding it during my tests but forgot to mentioned it in the article. However I see it in my prefs.js file and I could remove it from there at any time if necessary.
Haven’t tried it with NoScript installed though.
[Reply]