Language Selection

English French German Italian Portuguese Spanish

Pop-up vulnerability found in major browsers

Filed under
Security

Several popular Web browsers contain a vulnerability that could be used by cybercriminals to steal personal data, security company Secunia has warned.

The flaw would allow a phishing attack in which a malicious JavaScript pop-up window appeared in front of a trusted Web site, Secunia said in an alert published Tuesday. This could trick a surfer into revealing data such as a password.

"The problem is that JavaScript dialog boxes do not display or include their origin, which allows a new window to open--for example, a prompt dialog box--which appears to be from a trusted site," said Secunia's advisory.

According to Secunia, the latest versions of Internet Explorer, Internet Explorer for Mac, Safari, iCab, Mozilla, Mozilla Firefox and Camino are all vulnerable. Opera 7 and 8 are affected, but not 8.01, according to Opera.

To take advantage of the flaw, a cybercriminal would have to direct a Web user from a malicious site to a genuine, trusted site such as an online bank, in a new browser window. The malicious site would then open a JavaScript dialog box in front of the trusted Web site, and a user might then be fooled into sending personal information back to the malicious site.

Microsoft has said it is investigating Secunia's claims. It encouraged surfers not to trust pop-up windows that don't include an address bar or a lock icon that verifies that it came from a certified source.

Mozilla Firefox developers have already been making moves to combat this kind of phishing attack. Back in April, a patch was developed that allows people to block Java and Flash-based pop-ups unless they came from trusted sites. Mozilla wasn't immediately available to comment on Secunia's claims.

Opera confirmed Wednesday that its latest browser, 8.01, would display the pop-up's origin, letting a user inspect its URL to see if it came from a trusted site.

"Once these things are discovered, there's a rush as everyone tries to fix the problem," Christen Krogh, Opera's vice president of engineering, told ZDNet UK.

Krogh also pointed out that Secunia had rated the vulnerability as "less critical."

"This could fool some users into giving out some data to a site that wouldn't otherwise be able to get that information. But it doesn't seem like the most important issue," Krogh said.

By Graeme Wearden
ZDNet UK

More in Tux Machines

OSS Leftovers

SUSE Leftovers

  • openSUSE Tumbleweed – Review of the Week 2016/48
    After releasing daily snapshots without interruption for 17 days, Tumbleweed did slow down a bit during the last week. As already mentioned in my last review, 1124 had been canceled due to an issue with sddm installing strange branding configurations. And later on, we ‘broke’ our own staging setup and needed to bootstrap a few of them, making the throughput much lower than you were used to. So, we ended up with 3 snapshots since my last review: 1125, 1128 and 1129.
  • Highlights of YaST development sprint 28
    November is over, Santa Claus elves start to stress and the YaST team brings you one of the last reports of 2016. Let’s see what’s new in YaSTland.

OSS: AI and Machine Learning

Ubuntu and Derivatives

  • Canonical Sues Cloud Provider, Mint Beta, Devuan Tour
    Ubuntu parent-company, Canonical, today posted that they've been in a dispute with "a European cloud provider" over their use of their own homespun version of Ubuntu on their cloud servers. Their implementation disables even the most basic of security features and Canonical is worried something bad could happen and it'd reflect badly back on them. The post read, "The home-grown images of this provider disable fundamental security mechanisms and modify the system in ways that are unsupportable. They are likely to behave unpredictably on update in weirdly creative and mysterious ways." They said they've spent months trying to get the unnamed provider to use the standard Ubuntu as delivered to other commercial operations to no avail. Canonical feels they have no choice but to "take legal steps to remove these images." They're sure Red Hat and Microsoft wouldn't be treated like this.
  • Taking a stand against unofficial Ubuntu images
    Ubuntu is amazing on the cloud because we work with cloud providers to ensure crisp, consistent and secure images which you can auto-update safely. On every major cloud—AWS, Azure, Google, Rackspace, SoftLayer and many more—you can be confident that ‘Ubuntu’ is Ubuntu, with the same commitment to quality that you can expect when you install it yourself, and we can guarantee that to you because we require that clouds offer only certified Ubuntu images.
  • Canonical Takes Stand Against Unofficial Ubuntu Images, Reportedly Risky & Insecure
    Mark Shuttleworth has written a new blog post where he's outlining a dispute Canonical is having with a European cloud provider over a breach of contract and "publishing insecure, broken images of Ubuntu" for its cloud customers. With these Ubuntu Cloud unofficial images reportedly being buggy, users are complaining to Canonical/Ubuntu, assuming it's an upstream issue. Having enough of that, they are now preparing for legal steps to remove the unofficial Ubuntu images from the particular cloud provider.
  • Linux Mint 18.1 “Serena” MATE – BETA Release
  • Linux Mint 18.1 “Serena” Cinnamon – BETA Release