Vulnerabilities / Threats

8/17/2010
02:18 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Firefox Flaw Facilitates Deception

Security companies see risk in a browser bug, but Mozilla's director of Firefox says users are safe.




Slideshow: 10 Killer Mac Applications
(click for larger image and for full photo gallery)
Firefox engineers are busy trying to fix a bug that prevents the browser from flagging Web addresses that have been disguised.

Disguising or obfuscating a Web address (URL) is a tactic employed by malware distributors to increase the likelihood of enticing potential victims to malicious Web sites.

Modern browsers commonly attempt to see through obfuscation techniques to identify unsafe Web addresses. But Firefox misses obfuscated URLs inside of iFrames, blocks of HTML code that add content to a Web page from a third party's server.

"[A] bug has been noticed in all versions of Firefox [that] fails to generate an alert when an obfuscated URL is being placed in iFrames," noted security company Armorize in a blog post on Monday. "In certain cases, [the vulnerability] can be used effectively in spreading malware and stealing sensitive information."

Armorize has posted a generic proof-of-concept exploit to demonstrate the flaw.

URL obfuscation and the misuse of iFrames are not new techniques, but they can nevertheless be combined effectively to dupe potential victims, observes Kaspersky Lab's security researcher Dennis Fisher in a blog post.

"Web-based attacks have been employing various forms of URL obfuscation for years now, and iFrames are a favorite of attackers because of their ability to perform malicious actions in the background of a victim's Web session," he wrote. "The new bug in Firefox could allow an attacker to combine these two techniques to prevent the browser from warning the victim that a URL has been modified, removing a key protection mechanism from the equation."

Mozilla's bug tracking system, Bugzilla, has an entry for the vulnerability, 570658, which indicates that a fix is underway.

Johnathan Nightingale, Mozilla's director of Firefox development, downplayed the significance of the issue.

"The concern expressed in the bug is that a page could be constructed with an embedded iFrame that uses a confusing URL," he said in an e-mailed statement. "Most users don't look at the HTML source of the pages they are loading, which is the only way you'd encounter this URL. We do not anticipate this bug would cause user confusion or deception. Firefox ships with built-in phishing and malware protection that warns users if they are attempting to visit a dangerous URL."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Four Faces of Fraud: Identity, 'Fake' Identity, Ransomware & Digital
David Shefter, Chief Technology Officer at Ziften Technologies,  6/14/2018
Meet 'Bro': The Best-Kept Secret of Network Security
Greg Bell, CEO, Corelight,  6/14/2018
Containerized Apps: An 8-Point Security Checklist
Jai Vijayan, Freelance writer,  6/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-9036
PUBLISHED: 2018-06-20
CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer, allowing attacks by low-privileged users against higher-privileged users.
CVE-2018-12327
PUBLISHED: 2018-06-20
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq ...
CVE-2018-12558
PUBLISHED: 2018-06-20
The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").
CVE-2018-6563
PUBLISHED: 2018-06-20
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti...
CVE-2018-1120
PUBLISHED: 2018-06-20
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call t...