[tor-talk] Security issue. Firefox in Tor Browser Bundle allows access to LAN resources. To fix: ABE of NoScript must be turn on by default

[Georg Koppen]

Yuri:
> On 01/20/2014 20:06, TT Security wrote:
>>
>> Maybe you'll be suprised but Firefox by default allow connections to
>> loopback interfaces if there is no disabled rule in firewall settings.
>> NoScript Add-On can solve the problem by ABE.
>>
>> I have Tor Browser Bundle 3.5 and Firefox 24.2.0 from there. Just open
>> some port on your computer(only for testing) for example local
>> web-server and try with Firefox from Tor Browser Bundle this page:
>> http://tortestprivacy.url.ph/ You will see :) (ABE must be turned off,
>> as by default)
> 
> I just tried stock Firefox 26.0 version, and it doesn't allow loopback
> access (FreeBSD version). I don't have firewall. So it must be an issue
> with the earlier FF, or maybe with TBB modifications to it.

I still see that with the latest Nightly on Linux.

Georg


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 862 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20140121/11635904/attachment.sig>