[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default



Yuri:
> On 01/20/2014 20:06, TT Security wrote:
>>
>> Maybe you'll be suprised but Firefox by default allow connections to
>> loopback interfaces if there is no disabled rule in firewall settings.
>> NoScript Add-On can solve the problem by ABE.
>>
>> I have Tor Browser Bundle 3.5 and Firefox 24.2.0 from there. Just open
>> some port on your computer(only for testing) for example local
>> web-server and try with Firefox from Tor Browser Bundle this page:
>> http://tortestprivacy.url.ph/ You will see :) (ABE must be turned off,
>> as by default)
> 
> I just tried stock Firefox 26.0 version, and it doesn't allow loopback
> access (FreeBSD version). I don't have firewall. So it must be an issue
> with the earlier FF, or maybe with TBB modifications to it.

I still see that with the latest Nightly on Linux.

Georg


Attachment: signature.asc
Description: OpenPGP digital signature

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk