Re: Firefox 2.0.0.6 Remote Variable Leakage vulnerability

[Michal Zalewski <lcamtuf () dione ids pl>]

On Sun, 12 Aug 2007, carl hardwick wrote:

> Firefox Remote Variable Leakage

I'm afraid don't entirely follow this attack - though I might be wrong...

The PoC, in essence, enumerates all Javascript variables and functions
that are publicly declared by the browser in the context of the current
page (after loading several chrome:// scripts in the security context of
the current page to inflate their count [1]).

Yes, there's plenty of variables and functions defined, but to consider
this a security vulnerability, one should demonstrate that:

  1) Sensitive user preferences are disclosed this way (for example, any
     non-trivial prefs.js setting),

  2) Variables set by other sites can be read in violation of same-domain
     policy.

Is this the case here?

[1] What I find troubling in your example is that chrome:// URLs are not
restricted on Internet-originating SCRIPT SRC=. I'm not sure there's any
sensitive data in Firefox chrome:// namespace, but it is certainly unwise
to assume this will always be the case for third-party plugins.

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/