Re: Is Mozilla's "patch" enough?

[Thomas Kaschwig <thomas () kaschwig net>]

Aviv Raff wrote:

> If an attacker has a file writing access to the user's default profile
> directory, or somehow manages to update/create the file user.js (or
> even worse - mozilla.cfg) he can override the patch's configuration
> change, and enable the shell protocol handler again.

Nobody should have write access to your user profile. If someone is able 
to modify your user.js file, (s)he can enable some worse options, e.g. 
the protocol handler for `hcp' or `vbscript', but this is not a security 
flaw of mozilla...

Thomas
-- 
PGP/GnuPG: http://www.kaschwig.net/kaschwig.gpg.asc * KeyID: 0x3D68D63A
Fingerprint: 274A 4CB8 B362 D593 39D6 0989 8FC3 725F 3D68 D63A
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html