10 replies to this topic

[Humpty]

Quote

There's a new bug reported in the way Firefox handles writes to the 'location.hostname' DOM property. The vulnerability could potentially allow a malicious website to manipulate the authentication cookies for a third-party site. The bug was submitted by Michal Zalewski and was tested with the current version of Firefox.

The bug could allow for the browser to appear as if were connecting to a bank, when in fact it would instead be receiving data from a bad guy.A demo of the vulnerability and a suggested work-around can be found here.

F-secure article

[krit86lr]

Oh, no! I hope it's fixed quickly.

[Humpty]

When I tested FF the noscript extension stopped the test site.

I then allowed the test site and I was supposedly vulnerable so I implemented the "about:config" setting and that seemed to fix it.

[Andavari]

Humpty, on Feb 15 2007, 04:10 PM, said:

I then allowed the test site and I was supposedly vulnerable so I implemented the "about:config" setting and that seemed to fix it.

Ditto, the fix works for me too in the interim. I wonder though if/when Mozilla fixes it if we'll have to remove the fix.

[JDPower]

Andavari, on Feb 16 2007, 08:58 PM, said:

Ditto, the fix works for me too in the interim. I wonder though if/when Mozilla fixes it if we'll have to remove the fix.

With it being a Mozilla suggested fix I wouldn't think so (wouldn't be surprised if the official fix just does the same thing)

[fireryone]

Quote

There's a new bug reported in the way Firefox...

Thanks I've fixed mine

[Sputnik]

fireryone, on Feb 17 2007, 01:53 AM, said:

Thanks I've fixed mine

Dito

[TeeJay3800]

I fixed mine too, but now www.howardforums.com will not load for me. Is this happening to anyone else?

[Humpty]

Howards Forum is loading OK here.

In case the test site for the fix can't be accessed.

An interim workaround suggested by Firefox developers is to Open Firefox, go to the Address Bar and type: about:config
Then right-click anywhere on the page to add a new string key: capability.policy.default.Location.hostname.set
Set its value to noAccess

[JDPower]

Humpty, on Feb 20 2007, 02:02 AM, said:

Howards Forum is loading OK here.

Working fine here too.

[Woody]

Works here as well.

God isn't that site weird? One guy on there has over 7500 posts, all about mobile phones!

The words Get and Life spring to mind.