The vulnerability is caused by the manner in which the two browsers handle a bitmap image file, according to a warning posted by Polish researcher Gynvael Coldwind of Vexillium.org. Coldwind also posted a video illustrating the problem.
According to Coldwind, an attacker can create a malicious bitmap file that extracts information from the browsers' memory. Some of the stolen data is randomly collected, but the attack also could collect valuable data, the advisory noted.
The harvested data contains various information, including parts of other websites, users' favourites and history, and other information," Coldwind said on Vexillium.org.
"This has been tested [and] a proof-of-concept exploit has been created," Coldwind said. However, he added that the exploit has not yet been released.
The vulnerability could also cause Firefox to crash. The flaw affects Firefox 220.127.116.11 and previous versions, as well as the beta version of Opera 9.50.
"Other browsers – [such as] Apple Safari – contain vulnerable BMP handling code," Coldwind noted in his report. "But since there is no way of acquiring the image data, it doesn't pose a serious threat. Then again, maybe the attacker could convince the user to do a screenshot and send it to [him].”
Coldwind said the Apple Safari browser "has a similar problem with certain GIF files."
In its advisory, US-CERT encouraged Mozilla Firefox users to upgrade to Firefox 18.104.22.168 and Opera users to upgrade to Opera 9.25.>
Opera Software did not respond to SCMagazineUS.com's request for comment.
See original article on scmagazineus.com
Firefox, Opera image file flaw may permit attackers to grab users' web history
By Jim Carr on Feb 21, 2008 9:52AM