# Mozilla / Mozilla Firefox User Interface Spoofing Vulnerability



## jgvernonco (Sep 13, 2003)

Mozilla / Mozilla Firefox User Interface Spoofing Vulnerability

SECUNIA ADVISORY ID:
SA12188

VERIFY ADVISORY:
http://secunia.com/advisories/12188/

CRITICAL:
Moderately critical

IMPACT:
Spoofing

WHERE:
From remote

SOFTWARE:
Mozilla 0.x
http://secunia.com/product/772/
Mozilla 1.0
http://secunia.com/product/97/
Mozilla 1.1
http://secunia.com/product/98/
Mozilla 1.2
http://secunia.com/product/3100/
Mozilla 1.3
http://secunia.com/product/1480/
Mozilla 1.4
http://secunia.com/product/1481/
Mozilla 1.5
http://secunia.com/product/2478/
Mozilla 1.6
http://secunia.com/product/3101/
Mozilla 1.7.x
http://secunia.com/product/3691/
Mozilla Firefox 0.x
http://secunia.com/product/3256/

DESCRIPTION:
A vulnerability has been reported in Mozilla and Mozilla Firefox,
allowing malicious websites to spoof the user interface.

The problem is that Mozilla and Mozilla Firefox don't restrict
websites from including arbitrary, remote XUL (XML User Interface
Language) files. This can be exploited to "hijack" most of the user
interface (including tool bars, SSL certificate dialogs, address bar
and more), thereby controlling almost anything the user sees.

The Mozilla user interface is built using XUL files.

A PoC (Proof of Concept) exploit for Mozilla Firefox has been
published. The PoC spoofs a SSL secured PayPal website.

This has been confirmed using Mozilla 1.7 for Linux, Mozilla Firefox
0.9.1 for Linux, Mozilla 1.7.1 for Windows and Mozilla Firefox 0.9.2
for Windows. Prior versions may also be affected.

NOTE: This issue appears to be the same as Mozilla Bug 244965.

SOLUTION:
Do not follow links from untrusted sites.

PROVIDED AND/OR DISCOVERED BY:
Reported in Mozilla Firefox by:
Jérôme ATHIAS (also created a PoC)

Reported in Mozilla by:
James Ross

ORIGINAL ADVISORY:
Original Advisory and Proof of Concept:
http://www.nd.edu/~jsmith30/xul/test/spoof.html

OTHER REFERENCES:
XUL Documentation:
http://www.xulplanet.com/

Mozilla Bug reference:
http://bugzilla.mozilla.org/show_bug.cgi?id=244965


----------



## Lobos (Apr 30, 2004)

Won't the spoof stick plugin cure that or at least let you know that is not a legitamite site.

Lobos


----------



## jgvernonco (Sep 13, 2003)

I don't know...I use IE and I always know I can't relax.


----------



## Lobos (Apr 30, 2004)

Don't worry JG I use firefox mostly now and I still cant relax lol :chgrin:


----------

