916583 - [SECURITY] Remote address book spam

Status: RESOLVED DUPLICATE of bug 690252

(Firefox for Android Graveyard :: Download Manager, defect)

Description

[deax0u]

Attachment: mkpayload.py

Hello,

I want to report a firefox android bug I've found. It's possible to fill the
address book with a special http response.

I've attached a python script to generate a .vcf file with junk contacts. If
this file is served as text/x-vcard it will trigger a download and
automatically import this file into the address book.

I've tested this on android 4.0.4.

There is no android security component, so I've filed it here.

I don't have any experience in writing such reports so I hope it's OK. Please feel free to contact me for further information.

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

bug 690252 should fix this. Will attach a test file.

Comment 3

[Kevin Brosnan [Ex-Mozilla]]

Attachment: example vCard

Comment 4

[Kevin Brosnan [Ex-Mozilla]]

Tested and verified that this is a duplicate of 690252

Comment 5

[deax0u]

Are there any further news?

I guess I didn't qualify for the T-shirt, right?

Also, this is quite embarrassing but my mailbox expired. If you've sent any mails I didn't get them. Please excuse me if you've been waiting for a reply somewhere.

I'm not able to open bug 690252 but I would appreciate some information about it, like the report date or a short summary of the issue described in the bug. I don't know if your policy allows that, though.

Thanks in advance.

Comment 6

[Kevin Brosnan [Ex-Mozilla]]

This bug was already fixed by disabling the auto launch of all files. Which is the fix for bug 690252. The fix landed in our integration tree on Sept 12th and was in our Nightly builds on Sept 13th or 14th. Since your bug was already fixed by the bug mentioned we closed it out as a duplicate.