Re: Firefox/MSIE focus stealing vulnerability - clarification

[Marcello Barnaba <marcello () softmedia info>]

Hi Michal,

On Monday 12 February 2007 00:01, Michal Zalewski wrote:
> After some research, I can offer this clarification:
>
>   1) The MSIE 7 attack vector I described is a distinctive, new
>      vulnerability that differs from the attack reported by Charles
>      McAuley and Bart van Arnhem. Attacks described by them were
>      fixed in MSIE7 (although MSIE6 is still exposed to the original
>      flaw).
>
>      My vulnerability attacks the same form control, but in a different
>      manner. Again, the demo for this vulnerability is here:
>      http://lcamtuf.coredump.cx/focusbug/ieversion.html
>
>   2) The Firefox attack vector is related to the Charles' CVE-2006-2894,
>      which in turn was a rediscovery of a problem known to Mozilla since
>      2000 (!); attempts to fix it in official releases failed because the
>      problem was repeatedly marked as a duplicate of a too narrowly
>      defined issue with control hiding. A broader redesign probably
>      eliminated the issue in development branches, but it still affects
>      Firefox 1.5 and 2.0.
>
>      This can be considered an independent rediscovery and a more
>      practical demonstration of a previously reported vulnerability.
>      The exploit is here: http://lcamtuf.coredump.cx/focusbug/index.html

I tested both the ff and ie version on both Safari 2.0.4 (419.3) and Konqueror 
3.5.5.

On the FF version, konqueror does not exhibit any behavior, lets you input 
text and no redirection is made. To my surprise, the IE version instead dumps 
all the keystrokes typed but does not copy them again into the textarea.
Hitting return causes a dialog "The following files will not be uploaded 
because they could be not be found", and the reason is because the file name 
is the whole input phrase.

On Safari the FF version does not dump anything either, just the first C 
keystroke is took and taken directly into oblivion :). OTOH the IE version 
exhibits the same behavior as konqueror, but the "select file" open dialog 
pops up whenever hitting space.

Regards
-- 
pub 1024D/8D2787EF  723C 7CA3 3C19 2ACE  6E20 9CC1 9956 EB3C 8D27 87EF

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/