Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
BID:11059
Info
Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
| Bugtraq ID: | 11059 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 26 2004 12:00AM |
| Updated: | Aug 26 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to [email protected]. |
| Vulnerable: |
Netscape Navigator 7.2 Netscape Navigator 7.1 Mozilla Firefox 0.9.3 Mozilla Browser 1.7.2 |
| Not Vulnerable: |
Netscape Navigator 7.0.2 |
Discussion
Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
Browsers based on the Gecko engine are reported prone to a content spoofing vulnerability when they are running on the Apple Mac OS X platform. It is reported that the vulnerability occurs when the browser is configured to employ 'Tabbed Browsing' functionality.
In essence, an XPCOM plug-in that is invoked in one tab will be drawn into the environment of alternate tabs that are open in the same browser window.
This vulnerability may be eexploited to spoof content and to aid in phishing style attacks.
Browsers based on the Gecko engine are reported prone to a content spoofing vulnerability when they are running on the Apple Mac OS X platform. It is reported that the vulnerability occurs when the browser is configured to employ 'Tabbed Browsing' functionality.
In essence, an XPCOM plug-in that is invoked in one tab will be drawn into the environment of alternate tabs that are open in the same browser window.
This vulnerability may be eexploited to spoof content and to aid in phishing style attacks.
Exploit / POC
Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
The following example is available:
Open this page in one tab:
http://securitywizardry.com/radar.htm
Open another page in an alternate tab.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
The following example is available:
Open this page in one tab:
http://securitywizardry.com/radar.htm
Open another page in an alternate tab.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Mozilla/Netscape/Firefox Browsers XPCOM Plug-In For Apple Mac OSX Content Spoofing Vulnerability
References:
References:
- [OSX] (Java applet, Real, QuickTime) XPCOM plug-ins draw on wrong tabs and lea (Bill McGonigle
- Netscape Homepage (Netscape)
- Netscape Navigator 7.2 failure to isolate browser tabs (was Re: Computer Networ ([email protected])
- Re: Netscape Navigator 7.2 failure to isolate browser tabs (was Re: Computer Ne ([email protected])
- Re: Netscape Navigator 7.2 failure to isolate browser tabs (was Re: Computer Ne (Rishi Khan