Berkeley CSUA MOTD:Entry 32624
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/25 [General] UID:1000 Activity:popular
5/25    

2004/8/2 [Computer/SW/WWW/Browsers] UID:32624 Activity:high
8/3     New Mozilla/Firefox vulnerability (no patch yet):
        http://secunia.com/advisories/12188
        \_ Proof of concept: http://www.nd.edu/~jsmith30/xul/test/spoof.html
2025/05/25 [General] UID:1000 Activity:popular
5/25    

You may also be interested in these entries...
2012/5/18-7/20 [Computer/SW/WWW/Browsers] UID:54392 Activity:nil
5/18    On my Win7 machine, I've been using a PuTTY ssh session to soda as a
        proxy for my FireFox to bypass my company's OpenDNS when I visit
        http://tv.yahoo.com and so on.  It has been working fine for a long while.
        However, in the past couple weeks or so, my FireFox would either take
        several minutes to load the page, or failes to load it after several
        minutes.  I haven't changed any settings on my Win7 machine.  Rebooting
	...
2012/4/23-6/1 [Computer/SW/WWW/Browsers] UID:54360 Activity:nil
4/19    My Firefox 3.6.28 pops up a Software Update box that reads "Your
        version of Firefox will soon be vulnerable to online attacks."  Are
        they planning to turn off some security feature in my version of
        Firefox?
        \_ Not as such, no, but they're no longer developing this version,
           so if a 3.6.x-targeted hack shows up, you're not going to get
	...
2012/2/5-3/26 [Computer/SW/WWW/Browsers] UID:54300 Activity:nil
2/5     How is Firefox on version 10, while I still have 3.6 installed.
        I wait for the X.1 versions and they never come out.
        \_ I'm also on 3.6.26.  It claims that versions 4 - 10 are all faster
           than 3.6.x, but do they use more memory?  Thx.
           \_ Newer Firefox versions use less memory too:
              http://www.maximumpc.com/article/news/mozillas_memshrink_program_brings_big_memory_savings_firefox_7
	...
2010/9/13-30 [Computer/SW/WWW/Browsers] UID:53956 Activity:nil
9/13    Blah blah android blah, ok other than the bootjack stomp of the
        phone marketing crap of this, does anyone know where to find the old
        Android TCL scripting framework that was used for automating
        and controlling desktop apps (like mozilla for example). Thx.
	...
2010/2/18-3/9 [Computer/SW/WWW/Browsers] UID:53713 Activity:nil
2/18    Why is there now Firefox 3.5.8 when there was already 3.6 a month ago?
        \_ Why is there Windows XP SP3 when there was already Vista?
           Generally companies manage patches for at least two levels of
           product.  -tom
           \_ I see.  So Fx 3.6 is more like a new version than an update to
              3.5.x.  --- OP
	...
2010/2/8-18 [Computer/SW/Apps/Media, Computer/SW/Apps] UID:53695 Activity:kinda low
2/5     I like Adobe Flash. When written correctly, it scales along
        with your browser size. It looks consistent on every single
        browser. It is predictable. On the other hand, I'm not a big
        fan of CSS/HTML, which for the most part, look wildly different
        between browsers, and don't even work consistently or
        correctly at times. So why do so many people (like Steve Jobs)
	...
2010/1/11-25 [Computer/SW/WWW/Browsers] UID:53625 Activity:nil
12/9    Does anyone know when Firefox will support Win7?  I can't find a
        roadmap page on http://mozilla.org.  Thx.
	...
2009/12/13-2010/1/13 [Computer/SW/WWW/Browsers] UID:53593 Activity:nil
12/12   http://www.axiis.org/examples/BrowserMarketShare.html#
        An unusual visualization of browser market share from 2002-now
        \_ 1. Is it coincidence that it looks so much like the Firefox logo?
           2. Is Chrome eating away Firefox's share?
           \_ Chrome's user base is pretty much the same user base
              as Firefox user base, and to some extent, Safari. The
	...
2009/12/2-9 [Computer/SW/WWW/Browsers] UID:53556 Activity:nil
12/2    IE usage down but still kicking the majority ass. Chrome is also
        rising up high, almost at the Safari level. Firefox isn't
        doing badly either. Sorry Opera, you had your chance.
        http://arstechnica.com/microsoft/news/2009/12/november-2009-browser-stats-ie8-passes-ie7.ars
        \_ As long  as Opera is the only browser you can use on your Wii,
           I see a fine long life ahead of it.
	...
2009/11/27-12/6 [Computer/SW/OS/OsX] UID:53546 Activity:low
11/27   What did you guys buy on Black Friday?
        \_ cold medicine
           \_ me too!
        \_ Nothing.
        \_ I bought a Mac Air for my wife when Mac Mall announced their
           "Black Friday sale" on Wednesday. But that was technically not
	...
2009/10/1-21 [Computer/SW/WWW/Browsers] UID:53417 Activity:moderate
10/1    I am thinking of installing firefox on soda under my home directory.
        Will this make me a hozer?
        \_ Possibly. I wonder if we should have another VM for that...btw,
           I remember someone saying they're glad we're not on FreeBSD
           anymore, but last I checked, a bunch of our stuff is on FreeBSD,
           but our login server is not.
	...
Cache (1333 bytes)
secunia.com/advisories/12188
Mozilla 17x Mozilla Firefox 0x Choose a product and view comprehensive vulnerability statistics and all Secunia advisories affecting it. Description: A vulnerability has been reported in Mozilla and Mozilla Firefox, allowing malicious websites to spoof the user interface. The problem is that Mozilla and Mozilla Firefox don't restrict websites from including arbitrary, remote XUL (XML User Interface Language) files. This can be exploited to "hijack" most of the user interface (including tool bars, SSL certificate dialogs, address bar and more), thereby controlling almost anything the user sees. A PoC (Proof of Concept) exploit for Mozilla Firefox has been published. This has been confirmed using Mozilla 17 for Linux, Mozilla Firefox 091 for Linux, Mozilla 171 for Windows and Mozilla Firefox 092 for Windows. NOTE: This issue appears to be the same as Mozilla Bug 244965. Provided and/or discovered by: Reported in Mozilla Firefox by: Jrme ATHIAS (also created a PoC) Reported in Mozilla by: James Ross Changelog: 2004-07-30: Added an additional Mozilla Bug reference. id=252198 Please note: The information, which this Secunia Advisory is based upon, comes from third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
Cache (1859 bytes)
www.nd.edu/~jsmith30/xul/test/spoof.html
This particular demo does not work in the Mozilla Browser, but I know of no reason one could not be created. For this spoof to have maximal effect, you must have the following settings at their default, out-of-the-box state: * Web Features | Advanced | Allow Javascript to hide the status bar * Default selection of toolbars and toolbar buttons * No particularly bizarre browser extensions installed * Javascript should be enabled. Tell me your operating system, exact Firefox build number (Help | About , down at the bottom), and what doesn't work. You can try the following things * Double-click on the padlock icon in the lower left corner (or in the URL bar, for the second spoof). While this isn't actually isn't quite the same thing (James Ross found a security flaw related to the loading of XUL), there is some discussion about spoofing in the comments. Because the spoof seemed so obvious, I was sure that somebody had done it before (they had, in fact, but the bugs on bugzilla were marked confidental), so I wasn't too concerned with actually filing a bug. Limitations Yes, the fake toolbar buttons don't do anything when clicked. A diligent bad guy could produce enough modified XULs to emulate nearly the entire browser. If the padlock icon can be made to work, anything can work. He doesn't know whether you use large toolbar icons or small ones, what your bookmarks are, or what sort of extensions you have installed. Jeff ps, Although you can't see it here, the XUL files are being preloaded at this page, so they pop up almost instantly when you activate them. Since I'm no Javascript guru, I used a clunky splunge to force them to be preloaded; that's why there are a few javascript errors listed in the console. I do not provide any guarantee that this page will be here in a year, so please don't link to it with expectation of permanency.