387140 - this website force the browser to resize and possible harmful download

Status: NEW

(Firefox :: Security, defect)

Description

[gabriel francisco]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty)
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty)

when I was searching in google, I clicked in a link. A small window message get open and firefox was in a corner. I took this screen shoot:: http://flickr.com/photo_zoom.gne?id=740231650&size=l . I couldn't to control firefox. and then this pop up, goes  to the flowing link: http://systemdoctor.com/download/2006/index.php?aid=awaymake_ed2&lid=cycl6&ex=1&ax=1
I was trying to close this link, but it wasn't susefull  until I download this stupid program .exe

Reproducible: Always

Steps to Reproduce:
1.I click in a link::
http://hotest-tgp-pics.com/?id=cyclop16
2. A message opened and firefox it was hide::
http://flickr.com/photo_zoom.gne?id=740231650&size=l
3. I was closing this pages but only when I downloaded the .exe program I could::
http://systemdoctor.com/download/2006/index.php?aid=awaymake_ed2&lid=cycl6&ex=1&ax=1
Actual Results:  
Just I have in my desktop the .exe file that don't run in ubuntu.

Expected Results:  
troubles, I can't control firefox. 

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty).
I am using MY_buff theme.

about:buildconfig

Build platform
target
i486-pc-linux-gnu

Build tools
Compiler 	Version 	Compiler flags
gcc 	gcc version 4.1.2 (Ubuntu 4.1.2-0ubuntu4) 	-Wall -W -Wno-unused -Wpointer-arith -Wcast-align -Wno-long-long -pthread -pipe
c++ 	gcc version 4.1.2 (Ubuntu 4.1.2-0ubuntu4) 	-fno-rtti -fno-exceptions -Wall -Wconversion -Wpointer-arith -Wcast-align -Woverloaded-virtual -Wsynth -Wno-ctor-dtor-privacy -Wno-non-virtual-dtor -Wno-long-long -fshort-wchar -pthread -pipe

Configure arguments
--host=i486-linux-gnu --build=i486-linux-gnu --prefix=/usr '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' --enable-default-toolkit=gtk2 --with-default-mozilla-five-home=/usr/lib/firefox --enable-pango --with-user-appdir=.mozilla --with-system-png=/usr --with-system-jpeg=/usr --disable-mailnews --disable-composer --disable-ldap --enable-postscript --disable-installer --disable-xprint --enable-crypto --disable-strip --disable-strip-libs --enable-canvas --enable-svg --enable-svg-renderer=cairo --enable-system-cairo --enable-mathml --disable-tests --disable-gtktest --disable-debug --enable-xft '--enable-optimize=-pipe\ -w\ -O2\ -g\ -fno-strict-aliasing' --with-system-zlib=/usr --without-system-nspr --enable-xinerama --enable-extensions=default --disable-pedantic --disable-long-long-warning --enable-single-profile --disable-profilesharing --enable-gnomevfs --enable-application=browser --disable-installer --disable-updater --enable-chrome-format=flat --disable-elf-dynstr-gc --enable-system-myspell --enable-libthai --with-distribution-id=com.ubuntu --enable-official-branding

Comment 1

[Steve England [:stevee]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a7pre) Gecko/2007070608 Minefield/3.0a7pre ID:2007070608

I see dodgyness from the site at http://hotest-tgp-pics.com/?id=cyclop16

Clicking the link takes me to a page that then reduces firefox's browser windows size to something small and moves it to the bottom right of the screen, and then puts a system dialog over the top warning about some nonsense. But clicking OK or CANCEL doesn't appear to make a difference to anything.

But if I then click on the flash area at the top (where the mock system dialog image is shown) I get a download of installdrivecleanerstart.exe

Comment 2

[Ria Klaassen (not reading all bugmail)]

I think that's because "Move or resize existing windows" is allowed by default in the advanced JavaScript options. 

Comment 3

[Marco Bonardo [:mak] (Away 10-21 August)]

resizing the browser could hide the phishing malware warning?

Comment 4

[gabriel francisco]

 .(In reply to comment #3)
> resizing the browser could hide the phishing malware warning?
> 

No because the browser stays in the background and can't be controlled I was trying moving the browser with the mouse, and maximazi and minimize but I couldn't