Potential vulnerability left after the patch in bug 585284

RESOLVED FIXED

Status

()

Core
XPConnect
RESOLVED FIXED
7 years ago
6 years ago

People

(Reporter: mrbkap, Assigned: mrbkap)

Tracking

1.9.2 Branch
x86_64
Linux
Points:
---

Firefox Tracking Flags

(firefox6 fixed, firefox7 fixed, firefox8 fixed, firefox9 fixed, status1.9.2 wontfix)

Details

(Whiteboard: [sg:high?][critsmash:investigating])

Attachments

(1 attachment)

(Assignee)

Description

7 years ago
Created attachment 464910 [details] [diff] [review]
wip

The patch in bug 585284 fixes the testcase in that bug, but I don't think that it deals with the cached principal stuff that is supposed to protect SJOWs from being used to access objects that the original caller doesn't have access to (I don't fully understand what it's supposed to do at the moment).

I don't know if this is actually exploitable, but I wanted to file a bug just in case...

Updated

7 years ago
Whiteboard: [sg:high?][critsmash:investigating]
Assignee: nobody → mrbkap
Blake, I'm assuming this is fixed on trunk now, but we still need this for the older branches, right?
mrbkap, can you comment on this wrt current trunk vs branches?
Blake, this is a non-issue on trunk now, right?
(Assignee)

Comment 4

6 years ago
Yes.
Excellent, marking as such.
status-firefox6: --- → fixed
status-firefox7: --- → fixed
status-firefox8: --- → fixed
status-firefox9: --- → fixed
Version: Trunk → 1.9.2 Branch
Given that we have no known way to exploit this, and no testcase, this doesn't seem worth fixing for 3.6 at this time. If someone can come up with a testcase then that's something we could look into, but as of now we have no testcase.

Comment 7

6 years ago
Thanks Johnny - that sounds reasonable. Marking as wontfix for 1.9.2.
status1.9.2: --- → wontfix
Group: core-security
Resolving "fixed" since this has apparently been fixed for months but I know of no way to verify.
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.