SecurityFocus

Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 14 2007 10:23PM
Michal Zalewski (lcamtuf dione ids pl) (2 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 15 2007 02:31PM
pdp (architect) (pdp gnucitizen googlemail com) (1 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 15 2007 02:58PM
Michal Zalewski (lcamtuf dione ids pl) (1 replies)

On Thu, 15 Feb 2007, pdp (architect) wrote:

> I wander whether we can execute code on about:config or about:cache.

Actually, there are several odd problems related to location updates and
location.hostname specifically, including one scenario that apparently
makes the script run with document.location in about: namespace.

I did not research them any further, so I can't say if they're
exploitable - but you can see a demo here, feel free to poke around:

http://lcamtuf.coredump.cx/fftests.html

Cheers,
/mz
http://lcamtuf.coredump.cx/

[ reply ]

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 15 2007 03:17PM
pdp (architect) (pdp gnucitizen googlemail com) (1 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 15 2007 03:25PM
pdp (architect) (pdp gnucitizen googlemail com) (1 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 16 2007 07:31AM
Base64 (base640 gmail com) (1 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 22 2007 01:08AM
Michal Zalewski (lcamtuf dione ids pl)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 14 2007 11:27PM
Ben Bucksch (news bucksch org) (1 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 14 2007 11:33PM
Peter Besenbruch (prb lava net) (1 replies)

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability Feb 15 2007 12:16AM
Daniel Veditz (dveditz cruzio com)