Your message dated Thu, 21 Apr 2005 01:23:20 -0400
with message-id <[EMAIL PROTECTED]>
and subject line Close
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 7 Feb 2005 09:26:25 +0000
>From [EMAIL PROTECTED] Mon Feb 07 01:26:25 2005
Return-path: <[EMAIL PROTECTED]>
Received: from vscan01.westnet.com.au [203.10.1.131]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Cy5A1-0002YF-00; Mon, 07 Feb 2005 01:26:25 -0800
Received: from localhost (localhost.localdomain [127.0.0.1])
by localhost (Postfix) with ESMTP id 86DB18D614
for <[EMAIL PROTECTED]>; Mon, 7 Feb 2005 17:25:53 +0800 (WST)
Received: from vscan01.westnet.com.au ([127.0.0.1])
by localhost (vscan01.westnet.com.au [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 21279-08 for <[EMAIL PROTECTED]>;
Mon, 7 Feb 2005 17:25:53 +0800 (WST)
Received: from dsl-202-72-168-241.wa.westnet.com.au
(dsl-202-72-168-241.wa.westnet.com.au [202.72.168.241])
by vscan01.westnet.com.au (Postfix) with ESMTP id A4E398C526
for <[EMAIL PROTECTED]>; Mon, 7 Feb 2005 17:25:52 +0800 (WST)
Subject: mozilla-firefox: vulnerable to IDN spoofing problems
From: pabs <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
X-Reportbug-Version: 3.7.1
X-Mutt-Fcc:
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="=-LLFYNxvH7yaMdKw7T8YI"
Date: Mon, 07 Feb 2005 17:25:56 +0800
Message-Id: <[EMAIL PROTECTED]>
Mime-Version: 1.0
X-Mailer: Evolution 2.0.3
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--=-LLFYNxvH7yaMdKw7T8YI
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Package: mozilla-firefox
Version: 1.0+dfsg.1-4
Severity: grave
Tags: security
Justification: user security hole
advisory: http://www.shmoo.com/idn/homograph.txt
demonstration: http://www.shmoo.com/idn/
highlights:
> I. Background
>=20
> International Domain Name [IDN] support in modern browsers allows attacke=
rs to=20
> spoof domain name URLs + SSL certs.
> III. The details
>=20
> Proof of concept URL:
>=20
> http://www.shmoo.com/idn/
>=20
> Clicking on any of the two links in the above webpage using anything but =
IE=20
> should result in a spoofed paypal.com webpage.
I confirm that this works on my sid machine.
> V. Workaround
>=20
> You can disable IDN support in mozilla products by setting 'network.enabl=
eIDN'=20
> to false.
I can confirm this works, but the domain not found message says
"http://www.paypal.com"; cannot be found, so it isn't exactly a great
workaround.
> VI. Vendor Responses
>
> Mozilla: Working on finding a good long-term solution; provided clear=20
> workaround for disabling IDN.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (990, 'unstable'), (101, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.4.27-2-k7
Locale: LANG=3Den_AU.UTF-8, LC_CTYPE=3Den_AU.UTF-8 (charmap=3DUTF-8)
Versions of packages mozilla-firefox depends on:
ii debianutils 2.11.2 Miscellaneous utilities specif=
ic t
ii fontconfig 2.2.3-4 generic font configuration lib=
rary
ii libatk1.0-0 1.8.0-4 The ATK accessibility toolkit
ii libc6 2.3.2.ds1-20 GNU C Library: Shared librarie=
s an
ii libfontconfig1 2.2.3-4 generic font configuration lib=
rary
ii libfreetype6 2.1.7-2.3 FreeType 2 font engine, shared=
lib
ii libgcc1 1:3.4.3-7 GCC support library
ii libglib2.0-0 2.6.2-1 The GLib library of C routines
ii libgtk2.0-0 2.6.1-2 The GTK+ graphical user interf=
ace=20
ii libidl0 0.8.3-1 library for parsing CORBA IDL =
file
ii libjpeg62 6b-9 The Independent JPEG Group's J=
PEG=20
ii libkrb53 1.3.6-1 MIT Kerberos runtime libraries
ii libpango1.0-0 1.8.0-3 Layout and rendering of intern=
atio
ii libpng12-0 1.2.8rel-1 PNG library - runtime
ii libstdc++5 1:3.3.5-8 The GNU Standard C++ Library v=
3
ii libx11-6 4.3.0.dfsg.1-10 X Window System protocol clien=
t li
ii libxext6 4.3.0.dfsg.1-10 X Window System miscellaneous =
exte
ii libxft2 2.1.2-6 FreeType-based font drawing li=
brar
ii libxp6 4.3.0.dfsg.1-10 X Window System printing exten=
sion
ii libxt6 4.3.0.dfsg.1-10 X Toolkit Intrinsics
ii psmisc 21.5-1 Utilities that use the proc fi=
lesy
ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) con=
figu
ii zlib1g 1:1.2.2-4 compression library - runtime
-- no debconf information
--=20
bye,
pabs
--=-LLFYNxvH7yaMdKw7T8YI
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQBCBzQk5Sc9mGvjxCMRAsaYAKChkKTJgD7PZHnMvbvsrfzDHnt3PgCgkK5L
hrvCE6QSttd87lD+PPsKXPI=
=m5CM
-----END PGP SIGNATURE-----
--=-LLFYNxvH7yaMdKw7T8YI--
---------------------------------------
Received: (at 293975-done) by bugs.debian.org; 21 Apr 2005 05:23:21 +0000
>From [EMAIL PROTECTED] Wed Apr 20 22:23:21 2005
Return-path: <[EMAIL PROTECTED]>
Received: from smtp.istop.com [66.11.167.126]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DOU9p-0005r0-00; Wed, 20 Apr 2005 22:23:21 -0700
Received: from apocalypse.kuroneko.ca (ip70-161.mtl.istop.com [66.11.161.70])
by smtp.istop.com (Postfix) with ESMTP id AECA92B3F7
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 01:25:41 -0400 (EDT)
Received: from nightcrawler.kuroneko.ca (nightcrawler.kuroneko.ca [192.168.0.3])
by apocalypse.kuroneko.ca (Postfix) with ESMTP id 5422F7C07E
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 01:23:20 -0400 (EDT)
Received: by nightcrawler.kuroneko.ca (Postfix, from userid 1000)
id 398AB198CCC; Thu, 21 Apr 2005 01:23:20 -0400 (EDT)
Date: Thu, 21 Apr 2005 01:23:20 -0400
From: Eric Dorland <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Close
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="mWXp4lmU9bb5aCfX"
Content-Disposition: inline
User-Agent: Mutt/1.5.8i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-0.4 required=4.0 tests=BAYES_00,ONEWORD,
UPPERCASE_25_50 autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--mWXp4lmU9bb5aCfX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Yeah, these have been fixed for a while.=20
--=20
Eric Dorland <[EMAIL PROTECTED]>
ICQ: #61138586, Jabber: [EMAIL PROTECTED]
1024D/16D970C6 097C 4861 9934 27A0 8E1C 2B0A 61E9 8ECF 16D9 70C6
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS d- s++: a-- C+++ UL+++ P++ L++ E++ W++ N+ o K- w+=20
O? M++ V-- PS+ PE Y+ PGP++ t++ 5++ X+ R tv++ b+++ DI+ D+=20
G e h! r- y+=20
------END GEEK CODE BLOCK------
--mWXp4lmU9bb5aCfX
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCZzjIYemOzxbZcMYRApWcAJ9pvDQGD1HzYtTbltDLcAXPPo0rIQCfQPzF
4Pc5rr/6T3ehgmOAjOD2aw0=
=1FKY
-----END PGP SIGNATURE-----
--mWXp4lmU9bb5aCfX--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
