[tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default

[Yuri]

On 01/20/2014 20:06, TT Security wrote:
>
> Maybe you'll be suprised but Firefox by default allow connections to 
> loopback interfaces if there is no disabled rule in firewall settings. 
> NoScript Add-On can solve the problem by ABE.
>
> I have Tor Browser Bundle 3.5 and Firefox 24.2.0 from there. Just open 
> some port on your computer(only for testing) for example local 
> web-server and try with Firefox from Tor Browser Bundle this page: 
> http://tortestprivacy.url.ph/ You will see :) (ABE must be turned off, 
> as by default)

I just tried stock Firefox 26.0 version, and it doesn't allow loopback 
access (FreeBSD version). I don't have firewall. So it must be an issue 
with the earlier FF, or maybe with TBB modifications to it.
Chrome-31 is also free of this problem.

Yuri