The Mozilla Security Blog has a post concerning a vulnerability that exists in the Firefox browser even when fully-patched. The vulnerability relates to extensions installed for Firefox that are “flat” rather than contained within a .jar.
A “flat” extension is different because it allows someone to travel outside the extensions directory to locations that are known about on a hard drive. An attacker could therefore explore what other software a machine has installed using this vulnerability. That, in itself, is not a threat, but it then allows that attacker to attempt to use vulnerabilities in those other pieces of software they know you have on your machine.
The blog post states:
A visited attacking page is able to load images, scripts, or stylesheets from known locations on the disk. Attackers may use this method to detect the presence of files which may give an attacker information about which applications are installed. This information may be used to profile the system for a different kind of attack … Users are only at risk if they have one of the “flat” packaged add-on installed. Examples of popular add-ons that are vulnerable include: Download Statusbar and Greasemonkey.
The vulnerability was originally discovered on hiredhacker.com before being detailed on the Mozilla Security Blog. A comment posted in response to the blog entry by Girgio Maone points out that the vulnerability can be stopped by using the NoScript extension, although this has not been verified yet by Mozilla.
Read more at PC Pro and the Mozilla bug report.
Matthew’s Opinion
At least with this threat it can be prevented by not using the flat packaged extensions, or possibly through using the NoScript extension. The security rating of the vulnerability is low as it should be due to there being preventative measures you can take.
The unfortunate aspect about bugs like this is that not everyone out there using Firefox is going to read articles like this detailing the exploit. Some users may therefore fall foul of it, and these same users are likely the ones who have not got the latest patches for the other software on their machines.
It is encouraging to see the Firefox community reacting to a vulnerability such as this so quickly. For example, a version of Download Statusbar has already been released that uses .jar instead of being flat packaged.