AusCERT - AL-2007.0024 -- [Win][UNIX/Linux] -- Cookie stealing and domain bypass vulnerability in Firefox

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
AL-2007.0024 -- [Win][UNIX/Linux] -- Cookie stealing and domain bypass vulnerability in Firefox
Date: 15 February 2007
References: AL-2007.0028

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0024 -- AUSCERT ALERT
                             [Win][UNIX/Linux]
        Cookie stealing and domain bypass vulnerability in Firefox
                             16 February 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Firefox version 2.0.0.1 and prior
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact:               Access Privileged Data
                      Inappropriate Access
Access:               Remote/Unauthenticated
Member content until: Friday, March 16 2007

OVERVIEW:
        
        A vulnerability has been disclosed in the Firefox web browser which
        could allow for a malicious website to read and modify cookies for 
        other domains. Public proof of concept code has been published and 
        Mozilla developers have acknowledged this vulnerability [1].


IMPACT: 

        Many web sites use cookies to manage authentication and/or session 
        tracking. Successful exploitation of this vulnerability may allow an
        an attacker to steal authentication information or replay past 
        sessions to secure web sites. Given the ease of exploitation and the 
        availability of proof of concept code, AusCERT anticipates malicious 
        websites will use this vulnerability to bypass authentication 
        mechanisms.


MITIGATION:

        Mozilla has not released software correcting this problem, however
        several mitigation strategies exist for this vulnerability:

        1. Do not allow web sites to set the "location.hostname" DOM 
           property. Steps to do this are:

           a) Go to the about:config page to access Mozilla's configuration 
              settings.

           b) Right click any where on this page and select "New", then
              "String".

           c) Enter "capability.policy.default.Location.hostname.set" 
              (without quotes) for the preference name.

           d) Enter "noAccess" (without quotes) for the preference value.

           This may also be done via modifying the user.js file, see [1] for 
           details on how to do this.

        2. Disable JavaScript or limit the execution of JavaScript to only 
           trusted sites using the NoScript Firefox extension [2].

        3. Configure Firefox to not accept cookies or accept cookies only 
           from trusted domains.

        Each of these mitigation strategies may interfere with the 
        functionality of legitimate web sites. AusCERT recommends that 
        administrators exercise discretion in the application of these 
        mitigation strategies. 


REFERENCES:

        [1] Bug 370445  Zalewski cookie setting / same-domain bypass 
            vulnerability
            https://bugzilla.mozilla.org/show_bug.cgi?id=370445

        [2] NoScript - JavaScript/Java/Flash blocker
            http://noscript.net/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRdT5oyh9+71yA2DNAQJxiwP6AneMxFsB8jKKQWHGL358mLYcZEzKVbSV
LlV07ZWUPOCULh3VX/wTOoO8JZq2hCvRRY87On76UuYU1/IomhyhlwhBKiCpijYI
y8zLo+UwZ/GTFMFax6nLyJP/R0So3DKIxfYv8jKwrlnV3HELA7isWkAqPljvGN2/
41ZlJcGGIc8=
=gFZh
-----END PGP SIGNATURE-----