[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default

To: tor-talk@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
From: Max Jakob Maass <max@xxxxxxxxxxxxx>
Date: Tue, 21 Jan 2014 11:10:15 +0100
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 21 Jan 2014 05:13:08 -0500
Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; t=1390299016; l=2163; s=domk; d=velcommuta.de; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:References: Subject:To:MIME-Version:From:Date:X-RZG-CLASS-ID:X-RZG-AUTH; bh=dIOJjha6Pl0uy26by/t5GNW09ZY=; b=D194vHZj5pfc0ErfNLpcKIChjDmOHs7t0jPTi4gKnPYJ22XIoQfwnd6uYl2Va8rSHjP IUy8HRJ6/Ha4D+5fmJ6lTqpH5yEvFI1ooKKxMvEukbb/4AsTqmjeWpqZMDIdr2pZi7xk4 rHOyBgpTBFq5UkNC+Rxtb7wrlvjQ9zEW9kU=
In-reply-to: <20140121100813.GA26701@xxxxxxxxxxxxxxxxx>
List-archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-id: "all discussion about theory, design, and development of Onion Routing" <tor-talk.lists.torproject.org>
List-post: <mailto:tor-talk@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
Openpgp: url=http://verify.velcommuta.de/gpg/3408825E.asc
References: <1390277171.428385.27196.8353@xxxxxxxxxxxxxxx> <52DE3764.9060607@xxxxxxxxxx> <52DE3B62.1060007@xxxxxxxxxxxxx> <52DE3DBD.4040300@xxxxxxxxxxxxx> <20140121100813.GA26701@xxxxxxxxxxxxxxxxx>
Reply-to: tor-talk@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-talk" <tor-talk-bounces@xxxxxxxxxxxxxxxxxxxx>
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 21.01.2014 11:08, Mike Cardwell wrote:
> * on the Tue, Jan 21, 2014 at 10:28:29AM +0100, Max Jakob Maass
> wrote:
> 
>> Christ. Chrome even allows to connect to other machines in LAN.
>> I successfully connected to my Raspberry Pi (only reachable via
>> LAN) by changing the IP in the source code from 127.0.0.1 to the
>> relevant IP.
>> 
>> So, appearently, Chrome allows you to enumerate the LAN and
>> interact with other machines in it. I'll see if there is a bug
>> report for that already.
>> 
>> Thanks for the Info, TT Security.
> 
> If you can use XMLHttpRequest to perform a request against a
> machine on your LAN that isn't using CORS, and then read the
> response, then there is a bug, and you will get a healthily sized
> cheque from Google or Mozilla for reporting it to them. If you
> can't read the response then there isn't a bug. What you're seeing
> is: how the web works.

Well, this happens if you don't have an apache ready to really test
this stuff and only use netcat. Thanks for the info, I'll show myself out.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQJ8BAEBCgBmBQJS3keFXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ4NEM0ODA5N0EzQUY3RDU1MTg5QTc3QUMx
NjlGOTYyNDM0MDg4MjVFAAoJEBafliQ0CIJe+X0P/jU0yAGGoP9tIXjZLk+I2doY
PZ7HEbjFJBcglaLD9r9S7wtUV5Y/K54Xo01Z2uMViT0zisJGMurnz4ITmFpc6JiN
wVDPRRr83R1lcrX9WQqUVrJgytk56+OsyjsK1vsw/24mpymGjIxvcs2Bjs+ac4tt
vG+eLclN5QMfu1wh5Rz63aadGiBqTZfdAXvtYr91WN1w/sfwSZzrPpwmOSBiwSl5
u+1y06UxgTgxWIxKZOzURBzomMoKTVDF7dx/w6rudTkDZIy4u1DYhmlKYp6sYK2G
5kF5YZaXCPEhT32s/yWSs8OGsZGOuY5hpRLi41PLqzczLTufRD98/uWKmDMS63X3
RrrUicYiqY27GR37d7CA5z7of7DlatDDEwY5UaiDxHa/I/6Zdp/k4jwzQl7d8J1i
zWIH3oIXopR8U93QHNiGMojjVMf6O6s0kMK+63UI07c7emHSOO8GhqyBfhxEPe+1
Far+5RDCszJAbEp2CFQIANsRZj9Ppbgoy9KKcjJb1YqqiFr4HF+oLmkaOt5o9XOA
nhm9de2fjOyZ6VwtFmJTwh+ymvfayTj85TAGi78IXOebf61EBINFnOXnoxSesBBT
33Tj6e2zc5N0V5c6qtHGB99R7Sj5U3Pklf3lDtMyCdJew7pwLm5gr5qEOAwi2d76
ZxGgA14bc5ILPlSVfZ7A
=YQ2B
-----END PGP SIGNATURE-----
-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

References:
- [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: TT Security
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Olivier Cornu
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Max Jakob Maass
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Max Jakob Maass
- Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
  - From: Mike Cardwell

Prev by Author: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Next by Author: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Previous by thread: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Next by thread: Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default
Index(es):
- Author
- Thread