Arbitrary code execution through unsanitized browser UI

sounds wrote: post #2

Mods, could we maybe point the URL to the Mozilla Security Advisory? https://www.mozilla.org/en-US/security/advisories/mfsa2018-0... This bug is fixed in Firefox 58.0.1.

Sure thing! We've updated the link from https://tools.cisco.com/security/center/viewAlert.x?alertId=....

Re: Arbitrary code execution through unsanitized browser UI

#6

Post by JohnTHaller » Wed, Jan 31, 2018, 11:05 PM UTC

forgotmypw wrote: post #4

Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.

Use Firefox ESR 52.x. Firefox 56 is insecure and should not be used: https://www.mozilla.org/en-US/security/known-vulnerabilities...

Re: Arbitrary code execution through unsanitized browser UI

#7

Post by eat_veggies » Wed, Jan 31, 2018, 11:06 PM UTC

Does this affect the Tor browser's ancient version of Firefox?

Re: Arbitrary code execution through unsanitized browser UI

#8

Post by orf » Wed, Jan 31, 2018, 11:12 PM UTC

forgotmypw wrote: post #4

Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.

Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it.

Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.

Re: Arbitrary code execution through unsanitized browser UI

#9

Post by orf » Wed, Jan 31, 2018, 11:17 PM UTC

Well, here is the patch with a relevant test: https://reviewboard.mozilla.org/r/215474/diff/3#index_header

Seems to create an iFrame, sets the source to "chrome://global/content/win.xul", then creates a div (with a NS) inside it and sets the content to:

   bar()Meh.

The expected results is the div contents is:

   Meh.

Re: Arbitrary code execution through unsanitized browser UI

#10

Post by danjoc » Thu, Feb 01, 2018, 12:06 AM UTC

orf wrote: post #8

forgotmypw wrote: post #4

Are any of these fixes being backported to 56.x? I am not ready to upgrade to 57+ yet.

Immediately stop using 56, downgrade to the LTS or upgrade to 57. 56 is not secure and there are a bunch of vulnerabilities in it. Offtopic: I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. It's troubling, seeing as this is a very technical and presumably security-conscious audience.

>Immediately stop using 56, downgrade to the LTS or upgrade to 57

58 is the fixed version.

>I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason.

That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people clinging to 56/52 like debris from a shipwreck. Anyone who points this out is granted invisibility powers on HN, so I can see how you would be unaware of this.