TUCoPS :: Browsers :: hack8008.htm

Firetabbing [mikx]
Firetabbing [Firefox 1.0]


The javascript security manager usually prevents that a javascript: URL from 
one host is opened in a window displaying content from another host. But 
when the link is dropped to a tab, the security manager does not kick in.

This can lead to several security problems scaling from stealing session 
cookies to the ability to run arbitrary code on the client system (depending 
on the displayed site or security setttings).

Tabbed browsing is a great feature to organize mutliple website, but after a 
while also tabs become too much. Now you have two options: Close tabs and 
open new ones (CTRL+W to close a tab, followed by a CTRL+click on a link to 
open a new one), or just recycle already open tabs by dragging links to 
them - the solution i prefer.




The bug is marked as fixed in bugzilla. Get a nightly build, compile on your 
own or wait for Firefox 1.0.1.

2005-01-27 Vendor informed (bugzilla.mozilla.org #280056)
2005-01-28 Vendor confirmed bug
2005-02-05 Vendor fixed bug
2005-02-07 Public disclosure

The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
assigned the name CAN-2005-0231 to this issue.

__Affected Software

Tested with Firefox 1.0 and Mozilla 1.7.5

__Contact Informations

Michael Krax  


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH