Frame Injection vuln affects all browsers

(not sure if this should be posted here.)

According to Secunia, an old vulnerability was discovered in many modern browsers, allowing malicious people to spoof the content of websites. The affected browsers include Safari, Konqueror, Opera, MSIE, and all Mozilla (Gecko-based) browsers.

You can test your browser with this detailed instructions.

> More information: Multiple Browsers Frame Injection Vulnerability
Internet Explorer Frame Injection Vulnerability

I do not know if there's any fixes available, however, you can safeguard yourself by checking the Page Info from context menu or View menu and check the child-window (frame)'s actual URL.

 

Hi Antony

it's actually in another thread over here but hiding pretty well - try post#39

as it affects just about all browsers, not Moz/NN specific, perhaps prepare to move!

thing is, how easy is it to nail the problem?

with IE, you simply turn off the "Navigate Sub-Frames across domains" option

if there's a similar way to nobble that "feature" in Netscape/Moz (or indeed any browser whatsoever) it would be highly useful if someone could give clear directions how to do it - regret I cannot answer either how, or indeed whether it can be done for Moz/NN - this computer isn't powerful enough for me to run them

the ability to put sites into security zones helps a lot

best wishes, HJ

 

Thanks HJ,

A SillyDog701 user reported Mozilla 1.7 on SuSE Linux is not affected.
Mozilla Firefox 0.91 and Mozilla 1.7 are not affected.

 

Using Mozilla 1.7, WXp Home

Mozilla 1.7 w/windows Xp home seems not to be vulnerable. At least I couldn't find any "injection ".

Bob

 

Hi Antony,

Thanks very much for alerting us to this vulnerability. I find that Netscape 7.1 is indeed vulnerable, however, Mozilla 1.7 passed the test with flying colors, as did Firefox 0.9.1.

Ramona

 

Everything else I tested is vulnerable, from earlier Netscapes, and Mozilla through 1.6. I was told that even 1.7RC3 is vulnerable.

 

Firefox 0.9.1 passed for me, but Opera 7.51 failed.

 

I verified this, and you are correct. IE6, and AOL9.0 are no longer vulnerable.