Mozilla is working to fix a browser flaw that could give attackers unauthorized
access to data on a victim's machine.

The problem is similar to other
data leakage flaws found in the open-source browser, according to researcher
Gerry Eisenhaur, who first reported
the problem on Saturday.

Eisenhaur has posted sample code that reads the contents of a Mozilla Thunderbird
preferences file, but he believes that attackers could get access to more information
with variations on his attack. "It's possible to load any JavaScript file
on a victim's machine," he wrote in his blog posting. "This looks
very interesting and may have bigger potential, but for now, it's just another
information disclosure [flaw]."

"It could become something more if there was an application that stored
sensitive data inside JavaScript files," he said via instant message. "Some
plugins have been known to store usernames and passwords."

"Its also just a powerful way to do recon," he added.

Hackers have discovered a number of flaws in recent months that take advantage
of the way that browsers pass information between different components within
the Windows operating system. Some of these URI (Uniform Resource Identifier)
protocol handler flaws have led to serious security problems for both Firefox
and Internet Explorer.

This latest flaw affects only certain Firefox add-ons, such as the Download
Statusbar or Greasemonkey, which store scripts in a fashion that lets them be
discovered on the hard drive, said Window Snyder, Mozilla's security chief in
a Wednesday
blog posting.

Firefox is investigating
the issue and has rated it as a low-severity problem, she said.

IDG News Service

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine