[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #22974 [Applications/Tor Browser]: NoScript (and Tor Browser) vulnerable to Mozilla Add-On Code Execution
#22974: NoScript (and Tor Browser) vulnerable to Mozilla Add-On Code Execution
--------------------------------------+--------------------------
Reporter: tom | Owner: tbb-team
Type: defect | Status: new
Priority: Medium | Milestone:
Component: Applications/Tor Browser | Version:
Severity: Normal | Resolution:
Keywords: | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
--------------------------------------+--------------------------
Comment (by gk):
Replying to [ticket:22974 tom]:
> Per #22966 it sounds like NoScript is not signed with a developer key
(the 'updateKey' feature described here: https://developer.mozilla.org/en-
US/Add-ons/Install_Manifests#updateKey )
>
> updateKey allows the extension developer to require updates be signed
with a key only they control. Without it, Mozilla can rewrite extensions
and effectively get arbitrary code execution via an add-on.
>
> There's a few things at play here.
>
> 1) We could disable add-on updating all together to mitigate this in 52.
That's the plan. We'll start with HTTPS-Everywhere (hopefully soon, #10394
is the ticket for that) and do the same with NoScript afterwards.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22974#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs