[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #6152 [Firefox Patch Issues]: Remove Chrome JS direct vectors to arbitrary machine code
#6152: Remove Chrome JS direct vectors to arbitrary machine code
----------------------------------+-----------------------------------------
Reporter: mikeperry | Owner: mikeperry
Type: enhancement | Status: new
Priority: major | Milestone:
Component: Firefox Patch Issues | Version:
Keywords: | Parent:
Points: | Actualpoints:
----------------------------------+-----------------------------------------
We should consider patching Firefox to remove ways that extension-level JS
can execute machine code.
Right now, this includes jsctypes, any ways there might be to load an
binary XPCOM component from a DLL at runtime (these may have been removed
with Firefox 4+'s new-style component registration), and maybe the ability
to launch apps from JS XPCOM.
I contend this doesn't make much sense to do until we have functional
sandboxes, though, because simply the ability read and write arbitrary
files can be used to bootstrap arbitrary code exec eventually.
It will also break addons that try to use this functionality. Most
notably, Moxie's Convergence relies on jsctypes.
However, once sandboxes are deployed, removing these features will block
the ability of UXSS exploits to directly attack certain system calls. This
will raise the bar for sandbox breakout for these types of bugs.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/6152>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs