3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
141 lines
5 KiB
Text
141 lines
5 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-02:16 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: GIF/JPEG comment vulnerability in Netscape
|
|
|
|
Category: ports
|
|
Module: netscape
|
|
Announced: 2002-03-12
|
|
Credits: Florian Wesch <fw@dividuum.de>
|
|
Affects: All Netscape ports with versions prior to 4.77
|
|
Corrected: 2001-04-07 16:41:36 UTC
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
Netscape Navigator or Communicator is a popular web browser, available
|
|
in several versions in the FreeBSD ports collection.
|
|
|
|
II. Problem Description
|
|
|
|
The GIF89a and JPEG standards permit images to have embedded comments,
|
|
in which any kind of textual data may be stored.
|
|
|
|
Versions 4.76 and earlier of the Netscape browser will execute
|
|
JavaScript contained in such a comment block, if execution of
|
|
JavaScript is enabled in the configuration of the browser.
|
|
|
|
The Netscape browser supports a non-standard URL scheme, `about:'.
|
|
Visiting `about:' URLs causes Navigator to display information which
|
|
may be sensitive. For example, `about:global' gives a listing of
|
|
recently accessed URLs; `about:cache' shows a similar listing, but
|
|
with the time each page was visited and the name of each corresponding
|
|
file in the disk cache; and `about:config' displays the full
|
|
configuration of the browser.
|
|
|
|
JavaScript executed from the comment block of a maliciously
|
|
constructed image can send information from an `about:' URL back to a
|
|
hostile Web server.
|
|
|
|
The Netscape ports are not installed by default, nor are they "part of
|
|
FreeBSD" as such: they are part of the FreeBSD ports collection, which
|
|
contains thousands of third-party applications in a ready-to-install
|
|
format. The ports collection shipped with FreeBSD 4.5 contains some
|
|
Netscape versions which are vulnerable to these problems.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security audit
|
|
of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
The browser can be caused to transmit sensitive information to a
|
|
hostile Web server, if JavaScript is enabled and a page on the server
|
|
is visited.
|
|
|
|
If you have not chosen to install a Netscape port or package, your
|
|
system is not vulnerable to this problem.
|
|
|
|
IV. Workarounds
|
|
|
|
Do one of the following:
|
|
|
|
1) Deinstall affected Netscape ports or packages, if any are installed.
|
|
|
|
2) Disable JavaScript. This can be done interactively by running
|
|
Navigator, going to the Edit menu, choosing Preferences, and changing the
|
|
setting in the Advanced section.
|
|
|
|
Alternatively, append the line:
|
|
|
|
user_pref("javascript.enabled", false);
|
|
|
|
to the $HOME/.netscape/preferences.js of every user. Users are likely
|
|
to want to re-enable JavaScript, because its use is required by some
|
|
Web sites. If they do, they could become vulnerable again.
|
|
|
|
3) Similarly, disable automatic loading of images. The corresponding
|
|
configuration line is:
|
|
|
|
user_pref("general.always_load_images", false);
|
|
|
|
Some Web sites require images. If users enable automatic loading, or
|
|
if they click the Images button, they could become vulnerable again.
|
|
|
|
4) Install a filtering proxy, and configure it to block all images
|
|
from untrusted sites. The www/adzap or www/adzapper ports may be
|
|
suitable. Doing this will make many Web sites unviewable.
|
|
|
|
V. Solution
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade your entire ports collection and rebuild the relevant Netscape
|
|
port, if available. Netscape binaries for several platforms, including
|
|
FreeBSD/i386, were discontinued before the release of 4.77.
|
|
|
|
2) Deinstall the old package and install a new package, obtained from the
|
|
following directories:
|
|
|
|
[i386]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/
|
|
linux-netscape-communicator-4.79.tgz
|
|
linux-netscape-navigator-4.79.tgz
|
|
|
|
[alpha]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/www/
|
|
netscape-communicator-4.78.tgz
|
|
|
|
3) Download a new port skeleton for the Netscape port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
NOTE: Since there are so many variations of the Netscape ports in the
|
|
FreeBSD ports collection they are not listed separately
|
|
here. Localized versions are also available in the respective language
|
|
subdirectory.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/Latest/portcheckout.tgz
|
|
|
|
VI. References
|
|
|
|
<URL:http://www.securityfocus.com/archive/1/175060>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.6 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBPI4O0lUuHi5z0oilAQHv/AP+PQ4rd6932o1k3UJqc/+a6jdA5rD0LH1g
|
|
GLki733Egvx7K7ChjjBO2mmHCRVsvIBy/dIU1rlX/YM5ncXT4Mpgm34eL6EzhjQq
|
|
CD/733AIw2jEvSICBNeG3W1ytCzj4qBetjkXlj8/wbi/1f27jyj3kW+kVZ9TX20A
|
|
gICIJdL948I=
|
|
=al/K
|
|
-----END PGP SIGNATURE-----
|