Mozilla Foundation Security Advisory 2008-40

2008-09-29T00:00:00
ID SECURITYVULNS:DOC:20582
Type securityvulns
Reporter Securityvulns
Modified 2008-09-29T00:00:00

Description

Mozilla Foundation Security Advisory 2008-40

Title: Forced mouse drag Impact: Low Announced: September 23, 2008 Reporter: Paul Nickerson, Liu Die Yu Products: Firefox, SeaMonkey

Fixed in: Firefox 3.0.2 Firefox 2.0.0.17 SeaMonkey 1.1.12 Description

Mozilla developer Paul Nickerson reported a variant of a click-hijacking vulnerability discovered in Internet Explorer by Liu Die Yu. The vulnerability allowed an attacker to move the content window while the mouse was being clicked, causing an item to be dragged rather than clicked-on. This issue could potentially be used to force a user to download a file or perform other drag-and-drop actions. Workaround

  1. open Options/Preferences dialog
  2. go to the "Content" tab
  3. click the "Advanced..." button on the same line as the "Enable JavaScript" checkbox
  4. UN-check the "Move or resize existing windows" box.

References

* https://bugzilla.mozilla.org/show_bug.cgi?id=329385
* CVE-2008-3837