Feeds

Firefox popup exploit allows file snooping

Pop goes the weasel

Build a business case: developing custom apps

A vulnerability in Firefox's popup blocker software creates a means to read files from affected systems, security researchers warn.

The flaw, coupled with some tricksy coding, establishes a mechanism for hackers to read user-accessible files on vulnerable system, thereby creating a means to swipe sensitive information. Firefox version 1.5.0.9 is known to be exposed to the exploit. Other versions of the popular web surfing package might also be affected.

The vulnerability was discovered by security researcher Michal Zalewski who said the exploit relies in part on the fact that normal URL permission checks, which would stop remote sites from accessing a user's filespace, are bypassed when a user chooses to manually allow a blocked popup.

For the attack to succeed hackers would have to place a predictably named file with exploit code on the target system, which sounds difficult but is far from impossible as a technical article on the flaw by Securiteam explains. ®

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?