SillyDog701

Message Centre 3.0

Skip to content

"Frame Injection" vuln affects all browsers

Firefox, Thunderbird, SeaMonkey, Camino, Mozilla, Netscape 6/7/8/9, and all Gecko-based browsers discussion and support forum.
(MozInfo701, Netscape Browser Archive)

Moderators: Antony, Edward, profman, Ramona

Post a reply

"Frame Injection" vuln affects all browsers

Postby Antony » Mon 05 Jul, 2004 4:44 am

According to Secunia, an old vulnerability was discovered in many modern browsers, allowing malicious people to spoof the content of websites. The affected browsers include Safari, Konqueror, Opera, MSIE, and all Mozilla (Gecko-based) browsers.

The problem is that the browsers don't check if a target frame belongs to a website containing a malicious link, which therefore doesn't prevent one browser window from loading content in a named frame in another window.


You can test your browser with this detailed instructions.

> More information: Multiple Browsers Frame Injection Vulnerability
Internet Explorer Frame Injection Vulnerability

I do not know if there's any fixes available, however, you can safeguard yourself by checking the Page Info from context menu or View menu and check the child-window (frame)'s actual URL.
UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8
User avatar
Antony
diamond member
diamond member
 
Posts: 14343
Joined: Tue 18 Jun, 2002 11:36 pm
Location: Sydney, Australia
Top

Postby DJGM » Mon 05 Jul, 2004 6:14 am

I've just tested that vuln using the instructions in Secunia's advisory. The browser I'm using at the
moment (Mozilla 1.7 on SUSE Linux) does not appear to be affected. No content from Secunia
appeared in any frames on the MSDN website that opened in the second browser window.

EDIT 1:
Having now just tested this in Netscape 7.1, the vuln is apparent in this browser.

EDIT 2:
Konqueror 3.2 on Linux also appears to be vulnerable to this bug.

EDIT 3:
Mozilla Firefox 0.9.1 is not affected.
UserAgent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040618
SeaMonkey = Swiss Army Knife: It's versatile, reliable, and contains useful tools.
Windows Internet Explorer = Old Swiss Cheese: Full of holes, and it stinks!
User avatar
DJGM
diamond member
diamond member
 
Posts: 4550
Joined: Wed 19 Jun, 2002 1:03 pm
Location: Manchester, England, UK
Top

Postby Edward » Mon 05 Jul, 2004 7:14 am

Opera 7.51 for Linux is affected by this.
UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i586) Opera 7.51 [en]
SillyDog701 Moderator
debian 6 - iceape - iceweasel - icedove - seamonkey
User avatar
Edward
Moderator
Moderator
 
Posts: 3568
Joined: Sun 01 Dec, 2002 7:15 pm
Top

Postby Antony » Mon 05 Jul, 2004 8:20 am

DJGM wrote:The browser I'm using at the
moment (Mozilla 1.7 on SUSE Linux) does not appear to be affected. No content from Secunia
appeared in any frames on the MSDN website that opened in the second browser window.

...

EDIT 3:
Mozilla Firefox 0.9.1 is not affected.

Thanks, DJGM,
Is the Mozilla Firefox 0.91 the Windows version or Mac version?

According to the Secunia,
    the vulnerability has been confirmed in the following browsers:
  • Opera 7.51 for Windows
  • Opera 7.50 for Linux
  • Mozilla 1.6 for Windows
  • Mozilla 1.6 for Linux
  • Mozilla Firebird 0.7 for Linux
  • Mozilla Firefox 0.8 for Windows
  • Netscape 7.1 for Windows
  • Internet Explorer for Mac 5.2.3
  • Safari 1.2.2
  • Konqueror 3.1-15redhat
  • Internet Explorer 5.01, 5.5, 6 for Windows.
However, that's not the whole list.
UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/125.2 (KHTML, like Gecko) Safari/125.8
User avatar
Antony
diamond member
diamond member
 
Posts: 14343
Joined: Tue 18 Jun, 2002 11:36 pm
Location: Sydney, Australia
Top

Postby DJGM » Mon 05 Jul, 2004 8:30 am

Antony wrote:Thanks, DJGM,
Is the Mozilla Firefox 0.9.1 the Windows version or Mac version?


Neither. It's the version for Linux.
UserAgent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040618
SeaMonkey = Swiss Army Knife: It's versatile, reliable, and contains useful tools.
Windows Internet Explorer = Old Swiss Cheese: Full of holes, and it stinks!
User avatar
DJGM
diamond member
diamond member
 
Posts: 4550
Joined: Wed 19 Jun, 2002 1:03 pm
Location: Manchester, England, UK
Top

Postby marcoos » Mon 05 Jul, 2004 8:57 am

Browsers based on Gecko 1.7 (for all operating systems), such as Mozilla suite 1.7 and Firefox 0.9.1 are immune to this attack (Secunia's report says this, too).
UserAgent: Mozilla/5.0 (X11; U; Linux i686; pl-PL; rv:1.7) Gecko/20040626 Firefox/0.9.1
marcoos
member
member
 
Posts: 36
Joined: Fri 21 Mar, 2003 1:13 pm
Location: Poland
Top

Postby Mandrake » Mon 05 Jul, 2004 9:05 am

It's good to see that Mozilla and Firefox are not effected by this latest flaw. This is certainly a good reason to upgrade to FireFox 0.9.1 or Mozilla 1.7.
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616
Core i7 920 | ASUS P6T Deluxe v2 | 3TB+ HDD | 12GB Corsair DDR3 | Radeon 4890 Xfire | X-Fi Titanium Fatal1ty | Logitech Z-5500 Speakers | Dell 3008WFP | Seven RC1
User avatar
Mandrake
Moderator
Moderator
 
Posts: 4160
Joined: Fri 13 Sep, 2002 6:35 am
Top

Postby Wellander » Mon 05 Jul, 2004 11:32 am

Hi,
How about Netscape 4.x and lower?
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a1) Gecko/20040520
Wellander
diamond member
diamond member
 
Posts: 2603
Joined: Mon 21 Oct, 2002 6:37 pm
Top

Postby Wellander » Mon 05 Jul, 2004 11:38 am

Hi,
I can not find it in 1.7 and 1.8a1.
I think that these browsers are safe.
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8a1) Gecko/20040520
Wellander
diamond member
diamond member
 
Posts: 2603
Joined: Mon 21 Oct, 2002 6:37 pm
Top

Postby Edward » Mon 05 Jul, 2004 11:43 am

Also affects Konqueror 3.2.1 under Linux.
UserAgent: Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux i586) Opera 7.51 [en]
SillyDog701 Moderator
debian 6 - iceape - iceweasel - icedove - seamonkey
User avatar
Edward
Moderator
Moderator
 
Posts: 3568
Joined: Sun 01 Dec, 2002 7:15 pm
Top

Postby Phoenix21692 » Mon 05 Jul, 2004 2:31 pm

I just tested the bug on Netscape Communicator 4.8 and it doesn't appear to be vulnerable. And yes, it doesn't affect Mozilla 1.7 either. Also, I tested the bug on the Release Candiates 1, 2, and 3 of Mozilla 1.7 and these were affected by the bug. Not only that, the flaw also affects Mozilla 1.3.1 and 1.4.2. I'm sure it would affect many of the older builds. So, that means most of the Mozilla builds, up to version 1.7 RC 3 are vulnerable.
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616
User avatar
Phoenix21692
silver member
silver member
 
Posts: 234
Joined: Mon 23 Jun, 2003 6:28 pm
Location: US
Top

Postby DJGM » Mon 05 Jul, 2004 2:43 pm

Elves21692 wrote:I just tested the bug on Netscape Communicator 4.8 and it doesn't appear to be vulnerable.


Now that's surprised me. Mind you, I'm sure Netscape 4.x has a ton of other security vulnerabilities,
so with that in mind, and also with it being technically ancient, Ns4.x is best avoided these days!
UserAgent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7) Gecko/20040618
SeaMonkey = Swiss Army Knife: It's versatile, reliable, and contains useful tools.
Windows Internet Explorer = Old Swiss Cheese: Full of holes, and it stinks!
User avatar
DJGM
diamond member
diamond member
 
Posts: 4550
Joined: Wed 19 Jun, 2002 1:03 pm
Location: Manchester, England, UK
Top

Postby Don_HH2K » Mon 05 Jul, 2004 3:31 pm

Great.. Any suggestions on what to do with my old PCs running NS6.1? K-Meleon appears to also be vulnerable, Mozilla won't work in versions above 0.9.4, and Firefox is just as slow for me as 0.9.5+ is...

If NS7.2 isn't released soon, I'll probably switch to Mozilla and possibly stay there. In that case, I hope I'll find a way to get AIM to integrate into Moz1.7..
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)
User avatar
Don_HH2K
Moderator
Moderator
 
Posts: 5112
Joined: Sun 09 May, 2004 3:59 pm
Top

Postby akbash » Mon 05 Jul, 2004 4:07 pm

Of all the security and crash fixes made since Netscape 6, this is a relatively minor one.
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a2) Gecko/20040704 Firefox/0.8.0+
akbash
silver member
silver member
 
Posts: 364
Joined: Mon 09 Feb, 2004 9:13 pm
Top

Postby Fulvio » Mon 05 Jul, 2004 5:51 pm

dluchini30 wrote:Great.. Any suggestions on what to do with my old PCs running NS6.1? K-Meleon appears to also be vulnerable, Mozilla won't work in versions above 0.9.4, and Firefox is just as slow for me as 0.9.5+ is...

If NS7.2 isn't released soon, I'll probably switch to Mozilla and possibly stay there. In that case, I hope I'll find a way to get AIM to integrate into Moz1.7..


1. The probability that anything so dangerous will happen to you, is, IMHO, unlikely.
2. Do not store sensitive information on your computer.
3. Give up.
UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616
A minority may be right, and a majority is always wrong
~ Henrik Ibsen
WinXP, SP3, 512 MB, FF10, SM2.7, TB10, IE8.0, PC Tools Firewall , Avast 6.x, JRE1.7_02
User avatar
Fulvio
Moderator
Moderator
 
Posts: 11825
Joined: Wed 19 Jun, 2002 10:08 am
Top
Next
Post a reply

Return to Firefox, SeaMonkey and Netscape

Who is online

Registered users: Google [Bot], Yahoo [Bot]

Powered by phpBB © phpBB Group
Cheap Web Hosting

support SillyDog701
[SillyDog701 home] [Netscape] [download NS] [MozInfo701] [MacCentre701] [Feedback] [Search] [Sitemap]
All messages posted in this forum do not necessarily represent SillyDog701. This forum is operated by Antony Shen. All rights reserved. Copyright Notice. Privacy Statement.		 get FirefoxMade on a Mac