|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
From: Thor Larholm (larholm
gmail.com)
Date: Mon Jun 04 2007 - 14:42:05 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Firefox 2.0.0.4 contains a fix for a directory traversal vulnerability
that allowed you to read local files through the resource protocol.
However, the patch only partially fixed the vulnerability on Windows
systems and accidentally circumvents an existing input validation
check.
The net result is that you can still read some local files on Windows
and all user accessible files on Linux/Unix/OS X, with all user
accessible files potentially readable as well on Windows through the
patch regression.
http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/
Cheers
Thor Larholm
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]