Firefox Exploit Found In The Wild

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Mozilla is asking all Firefox users to upgrade immediately to version 39.0.3.

The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation (the “same origin policy”) and Firefox’s PDF Viewer. Mozilla products that don’t contain the PDF Viewer, such as Firefox for Android, are not vulnerable. The vulnerability does not enable the execution of arbitrary code but the exploit was able to inject a JavaScript payload into the local file context. This allowed it to search for and upload potentially sensitive local files.
 
Firefox's PDF reader is junk anyway. I open a document in it, and it is blurry, and sometimes unreadable. Open it up in Acrobat reader, and it is crisp text and images all the way.
 
I'm not a fan of in browser PDF viewing. I always use an external reader (for better or worse). That said, I suspect if people with noscript, were at no risk (assuming most block all javascript unless it's white listed)
 
I've been using the PDF reader for while, it's not great but I avoid Adobe's products. I figured it wouldn't be long before someone figure out a way to exploit it. I use Adblock, NoScript and browse in Sandboxie so chances are I wouldn't be affected.
 
Always maintain two user accounts for this type of thing. One account that carries your private keys, and the other for basically everything else.
 
You must log in or register to reply here.
Back
Top