Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Feb 22 2007 01:12PM
pdp (architect) (pdp gnucitizen googlemail com) (2 replies)
Re: [Full-disclosure] Firefox bookmark cross-domain surfingvulnerability Feb 23 2007 01:23AM
Daniel Veditz (dveditz cruzio com)
pdp (architect) wrote:
> However, here is an interesting thought for you: instead of asking the
> user into bookmarking a page you can supply the bookmark directly to
> their browser by using Live Bookmarks. So, a mainstream attack will be
> when a SPLOG network injects malicious links into their feeds. If
> someone happens to be subscribed to this network with a Live Bookmark
> and they click on it... well you know.
>
> I haven't tested this, although it should work.

It doesn't work -- thankfully we thought of that back when we implemented
Live Bookmarks in Firefox 1.0

[ reply ]
Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Feb 22 2007 01:33PM
Michal Zalewski (lcamtuf dione ids pl) (1 replies)
Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability Feb 22 2007 01:43PM
pdp (architect) (pdp gnucitizen googlemail com)


 

Privacy Statement
Copyright 2010, SecurityFocus