1161886 - Firefox leaves important websites vulnerables to clickjacking

Status: RESOLVED FIXED

(Firefox :: General, defect)

Description

[Santiago]

Attachment: firefox_clickjacking.html

How the name says, this Firefox vulnerabilitie leaves important websites vulnerable to clickjacking. Ex: https://www.mozilla.org, etc.

With the HTML exploit, i execute it in the browser and i see that the iframe is showing the website. So, an attacker can do a clickjacking attack to that website and change the account settings of the victim.

PD: This vulnerabilitie only works in Debian, my version is 6.0.1.

Comment 1

[:Gijs (he/him)]

Debian 6.0.1 has an ancient version of Firefox/Iceweasel (3.5.something) which is no longer supported. It is Debian's issue if they don't ship a version that has security fixes. On modern versions of Firefox, the frame loads nothing and produces an error:

Load denied by X-Frame-Options: https://www.mozilla.org/en-US/ does not permit framing.

Comment 2

[Mike Hommey [:glandium]]

(In reply to :Gijs Kruitbosch from comment #1)
> Debian 6.0.1 has an ancient version of Firefox/Iceweasel (3.5.something)
> which is no longer supported. It is Debian's issue if they don't ship a
> version that has security fixes.

More importantly, Debian 6 *is* an ancient version of Debian which is no longer supported, and hasn't been for about one year. As for Iceweasel in Debian 6, it hasn't been supported for 2 years.