Mozilla Cross-Site Scripting Vulnerability Reported and Fixed

Saturday February 28th, 2004

roseman wrote in to tell us about a cross-site scripting vulnerability in Mozilla, which was discovered and fixed in December last year. An advisory from Secunia refers to the flaw as "Less critical", while a SecurityTracker note gives more precise details of the bug, which could allow a malicious site to read another site's cookies or access other data recently submitted by the user. Both advisories note that a fix is available in Mozilla 1.6 Beta, though Secunia confusing also states that the issue has been patched in 1.4.2, which worried roseman as he could not find any links to this release. What Secunia should have said is that a fix for the flaw has been checked in to the 1.4 branch and that it will be available in Mozilla 1.4.2 when it is released.

The bug was handled in line with the Mozilla security bug policy, with reporter Andreas Sandblad emailing on December 2nd and members of the Mozilla security bug group filing a confidential bug report the next day (bug 227417). A fix was developed and checked in to both the trunk and the baseline 1.4 branch the same day. Sites such as Secunia and SecurityTracker only publicised the flaw after the bug report was opened to the public on Wednesday.

In this case, the vulnerability was relatively minor and a fix was applied before knowledge of it became widespread. It is not the sort of issue that MozillaZine would normally report on but we do so to address the concerns of worried users such as roseman and because it is a near-textbook example of the correct use of the Mozilla security bug policy.

#7 [nt] want your favorites--mozilla 1.5a and above.

by smkatz

Monday March 1st, 2004 1:55 PM

You are replying to this message

deceptive marketing practices.. at no point does it say that development has discontinued.. on the contrary, they imply that there are trained technicians ready to speak to you.

<> (the elements of tort--useful when determining whether someone has done you damage.)

I think Netscape/AOL had a duty to warn customers that they are no longer developing or supporting the browser.

I've set Netscape as my homepage and have signed the petition at <> --Sam