You are currently viewing a snapshot of www.mozilla.org taken on April 21, 2008. Most of this content is highly out of date (some pages haven't been updated since the project began in 1998) and exists for historical purposes only. If there are any pages on this archive site that you think should be added back to www.mozilla.org, please file a bug.

Skip to main content

You are here: Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.2) > MFSA 2007-05

Mozilla Foundation Security Advisory 2007-05

Title: XSS and local file access by opening blocked popups
Impact: Moderate
Announced: February 23, 2007
Reporter: shutdown, Michal Zalewski
Products: Firefox, SeaMonkey

Fixed in: Firefox 2.0.0.2
  Firefox 1.5.0.10
  SeaMonkey 1.0.8

Description

shutdown reported that if you could convince a user to open a blocked popup you could perform a cross-site scripting attack against any site that contains a frame whose source is a data: URL. To accomplish this the attacker's site would have to frame the target site plus another frame whose source is the exact same data: url as the victim site, and then attempt to open a popup with a javascript: url from the data: frame. It is unclear whether any high-value target sites that match this description actually exist.

Similarly, Michal Zalewski reported that although pages loaded from the web normally cannot open windows containing local files, if you could convince a user to open a blocked popup then this restriction could be bypassed. In order to take advantage of this flaw the attacker would have to know the full path to a locally-saved file containing malicious script. He also reported that a flaw in the seeding of the pseudo-random number generator resulted in downloaded files being saved to temporary files with a reasonably predictable name. The two combined could be used to steal information saved on the local disk.

Workaround

Do not open blocked popups individually, instead either ignore them or decide to enable popups on a per-site basis.

References