Mozilla Firefox 3.6 window.location对象非授权数据访问漏洞

2010-03-2400:00:00

Root

www.seebug.org

EPSS

0.003

Percentile

68.2%

JSON

CVE ID: CVE-2010-0170

Firefox是一款流行的开源WEB浏览器。

由于开发了新的机制来强制窗口与帧之间的同源策略，Firefox 3.6的浏览器引擎将window.location对象更改为正常的可覆盖JavaScript对象。但一些插件也使用这个对象判断页面来源以实施访问限制，因此恶意网页可以通过覆盖这个对象欺骗插件允许到其他站点或本地文件系统上数据的访问。

Mozilla Firefox 3.6
厂商补丁：

Mozilla

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.mozilla.org/


                                                &lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;!--
https://bugzilla.mozilla.org/show_bug.cgi?id=541530
--&gt;
&lt;head&gt;
  &lt;title&gt;Test for Bug 411103&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;pre id=&quot;test&quot;&gt;
&lt;script class=&quot;testbody&quot; type=&quot;text/javascript&quot;&gt;

var passed = true;
function ok(test, message) {
    if (!test) {
        alert(&quot;FAIL: &quot; + message);
        passed = false;
    }
}

var orig = window;
window = {};

var origLocation = location;

ok(window === orig, &quot;can't override window&quot;);
ok(window.location === location, &quot;properties are properly aliased&quot;);
ok(document.location === location, &quot;properties are properly aliased&quot;);

try {
    __defineGetter__('window', function() {});
    ok(false, &quot;should not be able to defineGetter(window)&quot;);
} catch (e) {
}

try {
    window.__defineGetter__('location', function(){});
    ok(false, &quot;should not be able to defineGetter(window.location)&quot;);
} catch (e) {
}

try {
    window.location.__defineGetter__('href', function(){});
    ok(false, &quot;shouldn't be able to override location.href&quot;);
} catch (e) {
}

try {
    window.location.__proto__.__defineGetter__('href', function(){});
    ok(false, &quot;shouldn't be able to use the prototype&quot;);
} catch (e) {
}

try {
    window.location.__defineSetter__('href', function(){});
    ok(false, &quot;overrode a setter for location.href?&quot;);
} catch (e) {
}

try {
    document.__defineGetter__('location', function(){});
    ok(false, &quot;shouldn't be able to override document.location&quot;);
} catch (e) {
}

location.watch('href', function() {
                          return &quot;javascript:ok(false, 'shouldn't be able to use watchpoints to mess things up')&quot;
                       });

ok(window === orig, &quot;can't override window&quot;);
ok(window.location === origLocation, &quot;properties are properly aliased&quot;);
ok(document.location === origLocation, &quot;properties are properly aliased&quot;);

location.href = 'javascript:ok(true, &quot;was able to set location.href through a watchpoint&quot;)';

alert(passed ? &quot;All tests passed&quot; : &quot;FAILED!&quot;);

&lt;/script&gt;
&lt;/pre&gt;
&lt;/body&gt;
&lt;/html&gt;

EPSS

0.003

Percentile

68.2%

JSON

Related for SSV:19335