I sit on the Firefox Beta channel; not seeing an update at the moment. Any word on the status of this?
Update: Just received an update to the latest Beta of 40.0. Haven't found the change log but assuming this was the reason.
Firefox exploit found in the wild
201–210 of 277 posts
Re: Firefox exploit found in the wild
#202Browsers are supposed to browse that's all. More and more stuff like this will come up with HTML5/JavaScript and people will begin to wonder why the world is jumping through all the JavaScript hoops to build a web app that is essentially a rich client app when they could use tools that are designed for that. Are they more or less secure, neither, once you can touch the user's filesystem the risk is the same which is…
So I shouldn't be upvoting your comment?
Re: Firefox exploit found in the wild
#203Re: Firefox exploit found in the wild
#204Re: Firefox exploit found in the wild
#205Earlier quoted context omitted.
The exploit basically uploaded the contents of a bunch of sensitive files to some server. Besides uploading the full list of files in the User directory (not the contents of the files) it uploaded the contents of the following files: Linux: /etc/passwd, /etc/hosts, /etc/hostname, /etc/issue, .bash_history, .mysql_history, .pgsql_history, .ssh/known_hosts, .ssh/authorized_keys , .ssh/id_ sa , .remmina/ .remmina, .remm…
Hi, I run the site https://scriptobservatory.org , which scans the internet and keeps track of what JavaScript people are sent as they browse the internet. Could you drop me an email with a copy of the exploit script (OR a list of a few unique strings found in the exploit script)? With that, I can search the history of what we've been sent to get a list of all webpages that this exploit has been seen on. Email is scr…
Cool, done!
Re: Firefox exploit found in the wild
#206Earlier quoted context omitted.
It's me. I discovered the exploit in the wild when I became a victim of it. Skill-set limited. I was able to identify it and understand what it basically does, but not much more.
Modest too, "The script triggered a file dialog showing it was trying to access a local file. I opened the Developer Tools and saw all kinds of other files being accessed, including my private and public keys. I nearly got a heart attack. I quickly revoked all SSH keys and started monitoring the requests to narrow it down before I submitted the bug ticket with all the information I had, including the exploit script t…
You're welcome. Yeah, that's exactly how I feel.
Re: Firefox exploit found in the wild
#207This is why I disable PDF viewing in any browser and have it send it to sumatraPDF instead
Re: Firefox exploit found in the wild
#208How many PDF.js security vulnerabilities have been found so far? A quick Google search found only four: https://www.mozilla.org/en-US/security/advisories/mfsa2013-9... (another local file disclosure) https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... (needs to be "combined with a separate vulnerability" to be exploitable) https://www.mozilla.org/en-US/security/advisories/mfsa2015-6... (needs to be "combi…
SumatraPDF is the only reasonable way to view a PDF safely.
http://www.sumatrapdfreader.org/free-pdf-reader.html
Not perfect but definitely not adobe or foxit and way safer than viewing in any browser.
Re: Firefox exploit found in the wild
#209Earlier quoted context omitted.
Yes it was so it would have prevented the exploit from loading.
Do you know if NoScript with javascript disabled but iframes allowed and pdfjs enabled would have stopped it? A vulnerability test would be really nice but I understand why it doesn't exist yet.
It would have stopped it. Js has to be active for the exploit script to run.
Re: Firefox exploit found in the wild
#210Earlier quoted context omitted.
You haven't the slightest understanding of software security, PDF.js was written to replace a component authored in a memory-unsafe language for which exploits were being found at a rate measured in tens per year. Since introduction PDF.js has only had 2 holes that were directly exploitable, neither leading to remote code execution which was the default behaviour for pretty much any bug found in Acrobat. If you don't…
That's not true. There have been PDF.js exploits that lead straight to RCE. This has the additional downside of leading to immediate compromise on every platform. Example (used by Mariusz Mlynski to win Pwn2Own this year): https://www.mozilla.org/en-US/security/advisories/mfsa2015-3...
Thanks for the link, and bummer, too late to edit my comment.. now I'll be wrong on the Internet for perpetuity :)