[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Remote Vulnerability in Firefox Extensions
- To: or-talk@xxxxxxxxxxxxx
- Subject: Re: Remote Vulnerability in Firefox Extensions
- From: coderman <coderman@xxxxxxxxx>
- Date: Thu, 21 Jun 2007 11:33:05 -0700
- Delivered-to: archiver@xxxxxxxx
- Delivered-to: or-talk-outgoing@xxxxxxxx
- Delivered-to: or-talk@xxxxxxxx
- Delivery-date: Thu, 21 Jun 2007 14:33:14 -0400
- Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=cdkqfYGQ5K6S5ylpqEzPgi386Y9ooJpwIQh/tOakOo3Q0U77+lQ+k/ntmXZvKIg1u08Iaibm4skxE0yJgSFvnZOJGfpjBPaf3wcXQlvcTkz9QJsqx7SIMWhijxiDOGdH4nfkbza5ABFDLvYcSlfS0mRrmgJkh2SnDz1oBM+lfV4=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=SmPXewFIElv/AcEGiQOJHKTbhidxcP7gXXNUCW3biyUijJsTHDI0rzs+pJSqbPiiJrTDyONfjyIIO0WX8bwiSBXe485EfSzU++qwhw8WxmTIPycuZi2pMi0m7XWj+hJLWuqLWnCGHagLM9CyMyqWvYjrm/9X+X1Mo/BhjUokqRQ=
- In-reply-to: <467ABD1A.7050704@xxxxxxxxxx>
- References: <4ef5fec60705300000i2e602059o402d0003749eb65a@xxxxxxxxxxxxxx> <467ABD1A.7050704@xxxxxxxxxx>
- Reply-to: or-talk@xxxxxxxxxxxxx
- Sender: owner-or-talk@xxxxxxxxxxxxx
On 6/21/07, scar <scar@xxxxxxxxxx> wrote:
...
it seems to me that many addons which are downloaded
from https://addons.mozilla.org/ use different, non-https,
addresses to check for and download updates.
the problem exists when non https is used for updates. any plugins
getting updates via http port 80 would be vulnerable.
would this vulnerability exist with all of those addons as
well? how to find out what address each addon uses to
download updates?
i haven't tested the various plugins myself. a sniffer should tell
you quickly if updates are performed insecurely, though you may need
trial and error to determine which one is making the requests if it
isn't obvious in the data.
this would be a good subject to document on the wiki if you pursue it :)
best regards,