Mozilla

Mozilla

Mozilla Foundation Security Advisory 2007-26

Privilege escalation through chrome-loaded about:blank windows

Announced
July 30, 2007
Reporter
moz_bug_r_a4
Impact
Moderate
Products
Firefox, SeaMonkey, Thunderbird
Fixed in
  • Firefox 2.0.0.6
  • SeaMonkey 1.1.4
  • Thunderbird 1.5.0.13
  • Thunderbird 2.0.0.6

Description

Mozilla researcher moz_bug_r_a4 reported that a flaw was introduced by the fix for MFSA 2007-20 that could enable privilege escalation attacks against addons that create "about:blank" windows and populate them in certain ways (including implicit "about:blank" document creation through data: or javascript: URLs in a new window).

Workaround

Any workaround would depend on the addon in question. One addon known to be affected was the Web Developer Toolbar, which was safe in its default configuration but potentially vulnerable to malicious web content if informational windows were opened as separate windows instead of tabs. The workaround for this, then, is to switch back to the default setting.

Other affected addons might not have a workaround other than to upgrade to a fixed version of Firefox.

References