[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability
- To: "pdp (architect)" <pdp.gnucitizen@xxxxxxxxxxxxxx>
- Subject: Re: [Full-disclosure] Firefox bookmark cross-domain surfing vulnerability
- From: Daniel Veditz <dveditz@xxxxxxxxxx>
- Date: Thu, 22 Feb 2007 17:23:13 -0800
pdp (architect) wrote:
> However, here is an interesting thought for you: instead of asking the
> user into bookmarking a page you can supply the bookmark directly to
> their browser by using Live Bookmarks. So, a mainstream attack will be
> when a SPLOG network injects malicious links into their feeds. If
> someone happens to be subscribed to this network with a Live Bookmark
> and they click on it... well you know.
>
> I haven't tested this, although it should work.
It doesn't work -- thankfully we thought of that back when we implemented
Live Bookmarks in Firefox 1.0
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/