Internet Explorer 7 and Firefox 2.0 share a logic flaw. The issue is actually more severe, as the two versions of the Microsoft and Mozilla browsers are not the only ones affected. In this regard, the vulnerability impacts Internet Explorer 5.01, Internet Explorer 6 and Internet Explorer 7 but also Firefox 1.5.0.9. Microsoft has stressed the fact that IE7 on Windows Vista is not affected in any manner.
Post a Comment
Member since:2005-07-06
Fans: 1
Is this FUD?
So for you Firefox is a reverse engineered version of IE...
Don't you know that HTML is a markup language universally known, so you can make yourself your personal rendering engine for html pages.. Would it be a reverse-engineered version of MS Internet Explorer? ....
....
-__- my god.
Member since:2006-12-18
Fans: 0
Member since:
2005-11-12
Fans: 1
I tried the demonstration at:
http://lcamtuf.coredump.cx/focusbug/ffversion.html
And nothing happened. This is Firefox 2.0.0.2 on XP. Perhaps the demonstration is buggy.
Member since:2006-05-18
Fans: 1
Member since:2006-02-12
Fans: 0
Member since:2006-01-26
Fans: 24
Member since:2005-10-13
Fans: 0
Member since:2005-11-15
Fans: 0
Member since:
2006-01-26
Fans: 24
So, it appears that using Javascript, the page is redirecting select input from the user to the file input box - and then uploading the file to the server once complete.
This doesn't really surprise me - but I wouldn't have thought of it 
So, mitigating factors appear to be: Have an exploitable browser, have a C:boot.ini (although any file could be used for this), have administrative priveleges (so that accessing boot.ini is possible for the browser in the first place) and have Javascript enabled.
For the record, it does work on my system... but I have to type very slowly as it's shifting focus around and has a hard time keeping up.
Edited 2007-02-27 18:51
Member since:
2006-01-07
Fans: 0
Member since:
2005-07-12
Fans: 4
The example won't work on my machine, since my boot.ini is on F: 
Worth noting it doesn't work in Opera either.
It's an interesting example - the javascript engines in both IE and FF only allow the most recent keypresses to be added to a file input... I think the example is a bit more complex than it needs to be - I'm gonna have to play with this. It should be possible to simply use the return state and CSS layering to do this a LOT simpler than how this example is working.
Member since:
2006-12-18
Fans: 0
Member since:2006-01-26
Fans: 24
Good point - in fact I believe I read that this problem exists on Firefox on Linux as well - allowing the upload of a file that the user has access to (i.e. /etc/passwd if the user is root) - would be interesting to see the same exploit written for that scenario 
update: oh, someone did
http://www.thanhngan.org/fflinuxversion.html
Edited 2007-02-27 21:30
Member since:2005-10-02
Fans: 21
Member since:2005-07-12
Fans: 4
>> Yeah, sure, since Vista doesn't have a boot.ini
>> it's not affected.
The example doesn't work - the technique itself DOES. Theoretically you could pull any file, so long as you were able to get the user to type in ALL the characters in the filename in the order you want them... Which is why embedding this into a blog, forums or any other large text entry box could be a easy way to gather information...
The above paragraph for example, could (in theory) be used to pull info.txt from the current default browser upload directory (notice the bits in italic)
Would be interesting to see if it could be exploited by making it look like some kind of captcha.
Edited 2007-02-28 01:49
Member since:2006-12-18
Fans: 0
Member since:
2006-01-20
Fans: 0
Member since:
2006-02-24
Fans: 0
Member since:2006-01-26
Fans: 24
Konqueror asks the user for confirmation when sending a local file
And I would hope this is exactly what will be done with Firefox. That feature along with whitelisting support should be sufficient, and I mean jeez - how often do people upload to a website. Usually one uses just a few such sites regularly (email, photo sharing...)
Not sure about IE, Microsoft has a habit of doing stupid things to "fix" exploits.
Member since:
2005-07-30
Fans: 0