Netscape 7/Mozilla 1.1 Security Issue

Although this was originally posted on the Internet 9/13/02:
http://news.zdnet.co.uk/story/0,,t272-s2122261,00.html

and again today:
http://www.silicon.com/bin/bladerunner?30REQEVENT=&REQAUTH=21046&14001REQSUB=REQINT1=55553

I thought users should be aware of the latest minor security issue in these two browsers.

As noted in the above Article, turning off JavaScript will do as a workaround until a patch is available for both browsers.

Ramona

 

Yet another mention...
http://online.securityfocus.com/archive/1/291378

Instead of disabling js (not an option for everyone), you can simply use this workaround.

in user.js/prefs.js add

user_pref( "capability.policy.default.Window.onunload ", "noAccess ");


Hopefully this is fixed soon.

tranquilo

 

tranquilo,

I have seen that script posted elsewhere. Also this question, which was never answered. Perhaps you can answer the question:

Adding the line to the user_pref didn't hurt, but does not stop all 'onUnload' functions. See, for example, http://www.idocs.com/tags/document/_BODY_onUnload.html
In this example all of the commands are executed locally. Does the "noAccess" block communications back to servers?

Thanks,

Ramona

 

True. I was able to stop that window from appearing by using the following (though I am not sure this all relates to the current privacy problem...)

I disabled the user.js for testing...

uncheck these two
open unrequested windows
raise or lower windows

or just add these to the prefs.js
user_pref( "dom.disable_open_during_load ", true);
user_pref( "dom.disable_window_flip ", true);


This worked even without this line

user_pref( "capability.policy.default.Window.onunload ", "noAccess ");


However, there is the possibility that some of the capability prefs could be combined to stop the alert window from that site. However, that would take a lot of testing (configure/test/restart/reconfigure/repeat).

http://www.mozilla.org/docs/dom/domref/dom_window_ref.html
http://www.mozilla.org/projects/security/components/ConfigPolicy.html

tranquilo