Mozilla

Mozilla

Mozilla Foundation Security Advisory 2005-17

Install source spoofing with user:pass@host

Announced
February 24, 2005
Reporter
Phil Ringnalda
Risk
Low
Impact
Low
Products
Firefox, Mozilla Suite, Thunderbird
Fixed in
  • Firefox 1.0.1
  • Mozilla Suite 1.7.6
  • Thunderbird 1.0.2

Description

The installation confirmation dialog shows the source of the software. By adding a long, fake "user:pass" in front of the true hostname the user might be convinced to trust software that comes from an untrustworthy source. This is similar to attempts used in some phishing mail: "http://www.mozilla.org@attacker.com/install.xpi".

By default Firefox only allows install attempts from http://update.mozilla.org, a user would need to explicitly allow the spoofing host to initiate installs before it could try this trick.

Workaround

Do not install software when prompted by untrusted sites. Enlarge the install confirmation dialog and verify that "@" does not appear before the first "/" character.

References