[warty] Firefox Window Injection Vulnerability

[John Dong]

http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

I am able to reproduce this flaw with Warty's firefox.

However, Hoary's firefox doesn't seem to suffer from this problem...

http://secunia.com/multiple_browsers_window_injection_vulnerability_test/: http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

[Martin Pitt (pitti)]

Relevant upstream bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=273699

No patch for now :-( Thom, do you know about any news about this?

[Chuck Short (zulcss)]

This is being tracked in bug #103638.

https://bugzilla.mozilla.org/show_bug.cgi?id=103638

Regards
chuck

[Matt Zimmerman (mdz)]

They are considered two separate bugs upstream; if they are indeed the same,
someone should point this out at bugzilla.mozilla.org

[Martin Pitt (pitti)]

I tested this again, Hoary is still vulnerable. However, there now is an
upstream patch (aka rewrite), so I think it is time for an update.

FYI, and for changelog inclusion, here is the CAN:

Candidate: CAN-2004-1156
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1156
Reference: MISC:http://secunia.com/secunia_research/2004-13/advisory/
Reference: MISC:http://secunia.com/advisories/13129/
Reference:
MISC:http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

Mozilla through 1.7.x, and Mozilla Firefox through 1.x, allows remote
attackers to spoof arbitrary web sites by injecting content from one
window into a target window whose name is known but resides in a
different domain, as demonstrated using a pop-up window on a trusted
web site, aka the "window injection" vulnerability.

[Martin Pitt (pitti)]

This bug certainly deserves to be owned by our Mozilla guru.

[Matt Zimmerman (mdz)]

This is marked as a critical security bug, and has been open for over a month
now. What is its status?

[Martin Pitt (pitti)]

(In reply to comment #6)
> This is marked as a critical security bug, and has been open for over a month
> now. What is its status?

This issue is fixed in FireFox 1.0.1 and Mozilla 1.7.6, both are supposed to be
packaged for Hoary.

Warty is a difficult issue, though. The proposed patch is huuuge and does not
apply at all to 0.9.3 (Thom already tried in vain for hours). Thus I have no
idea how this could be fixed in Warty.

[Thom May (thombot)]

 mozilla-firefox (1.0.1-2ubuntu1) hoary; urgency=low
 .
   * Resynchronise with Debian.
     Security fixes: CAN-2004-1156 - Window Injection Vulnerability
                     CAN-2005-0232 - Fireflashing
                     CAN-2005-0231 - Firetabbing
   * Add patch to render hebrew RtL rather than LtR
   * Add patch to make ',' on the numpad work correctly (Ubuntu: #6301)

[Martin Pitt (pitti)]

Warty was fixed in USN-149-3.