TITLE: Firefox Greasemonkey Extension Disclosure of Sensitive Information SECUNIA ADVISORY ID: SA16128
VERIFY ADVISORY: http://secunia.com/advisories/16128/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information WHERE: >From remote SOFTWARE: Greasemonkey 0.x (extension for Firefox) http://secunia.com/product/5420/ DESCRIPTION: Mark Pilgrim has reported a vulnerability in the Greasemonkey extension for Firefox, which can be exploited by malicious people to disclose various information. The vulnerability is caused due to certain functions being insecurely exposed and can be exploited by a malicious web site via the "GM_xmlhttpRequest()" function to disclose the contents of arbitrary local files and list the contents of arbitrary local directories. Successful exploitation requires that a Greasemonkey script is configured to run on the malicious web site. The vulnerability has been reported in versions prior to 0.3.5. SOLUTION: The vulnerability has been fixed in version 0.3.5 by reducing the functionality. ORIGINAL ADVISORY: http://greaseblog.blogspot.com/2005/07/mandatory-greasemonkey-update.html ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
