For you Mozilla Firefox users...
#2
Scooby Regular
Join Date: Feb 2004
Location: High Wycombe
Posts: 3,763
Likes: 0
Received 0 Likes
on
0 Posts
Doesn't seem to be a big issue. . . a javescript that can show passwords that are entered into a box? Surely only an issue if a site has been hijacked?
Or did i miss the point?
Or did i miss the point?
Originally Posted by JackClark
#3
Scooby Senior
Thread Starter
DESCRIPTION:
A vulnerability has been reported in Mozilla and Mozilla Firefox, allowing malicious websites to spoof the user interface.
The problem is that Mozilla and Mozilla Firefox don't restrict websites from including arbitrary, remote XUL (XML User Interface
Language) files. This can be exploited to "hijack" most of the user interface (including tool bars, SSL certificate dialogs, address bar and more), thereby controlling almost anything the user sees.
The Mozilla user interface is built using XUL files.
A PoC (Proof of Concept) exploit for Mozilla Firefox has been published. The PoC spoofs a SSL secured PayPal website.
This has been confirmed using Mozilla 1.7 for Linux, Mozilla Firefox 0.9.1 for Linux, Mozilla 1.7.1 for Windows and Mozilla Firefox 0.9.2 for Windows. Prior versions may also be affected.
A vulnerability has been reported in Mozilla and Mozilla Firefox, allowing malicious websites to spoof the user interface.
The problem is that Mozilla and Mozilla Firefox don't restrict websites from including arbitrary, remote XUL (XML User Interface
Language) files. This can be exploited to "hijack" most of the user interface (including tool bars, SSL certificate dialogs, address bar and more), thereby controlling almost anything the user sees.
The Mozilla user interface is built using XUL files.
A PoC (Proof of Concept) exploit for Mozilla Firefox has been published. The PoC spoofs a SSL secured PayPal website.
This has been confirmed using Mozilla 1.7 for Linux, Mozilla Firefox 0.9.1 for Linux, Mozilla 1.7.1 for Windows and Mozilla Firefox 0.9.2 for Windows. Prior versions may also be affected.
#4
I can't work out if this is potentially very serious (ie whole UI hijack) or trivial. I also can't see if the patch is available for download, although the code change looks extremely simple
#5
Scooby Senior
Thread Starter
That's the problem. How can I recommend software like this to my mother when I don't understand what's going on, if it'll be fixed and when.
#6
Scooby Regular
Join Date: Feb 2004
Location: High Wycombe
Posts: 3,763
Likes: 0
Received 0 Likes
on
0 Posts
it would seem to be a problem if a site (or a PC) has already been compromised.
The flaw on it's own is isn't a problem - unless you are a victim of phishing
The flaw on it's own is isn't a problem - unless you are a victim of phishing
#7
Scooby Regular
Originally Posted by JackClark
That's the problem. How can I recommend software like this to my mother when I don't understand what's going on, if it'll be fixed and when.
Thread
Thread Starter
Forum
Replies
Last Post