Mozilla Foundation Security Advisory 2008-57

Mozilla Foundation Security Advisory 2008-57

Title: -moz-binding property bypasses security checks on codebase principals
Impact: High
Announced: November 12, 2008
Reporter: Collin Jackson
Products: Firefox, SeaMonkey

Fixed in: Firefox 3.0.4
Firefox 2.0.0.18
SeaMonkey 1.1.13
Description

Security researcher Collin Jackson reported that the -moz-binding CSS property can be used to bypass security checks which validate codebase principals. Similar to the issue reported in MFSA 2008-23, Jackson demonstrated that an attacker can replace a stylesheet in a signed JAR which uses relative paths, and can then use the -moz-binding property to inject malicious script into the JAR. The injected script will be executed with the privileges of the signed JAR. This vulnerability can thus allow an attacker to run arbitrary JavaScript within the context of another site.
Workaround

Disable JavaScript until a version containing these fixes can be installed.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=424733
* CVE-2008-5023