Your message dated Thu, 21 Apr 2005 01:23:20 -0400
with message-id <[EMAIL PROTECTED]>
and subject line Close
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 9 Feb 2005 19:06:15 +0000
>From [EMAIL PROTECTED] Wed Feb 09 11:06:15 2005
Return-path: <[EMAIL PROTECTED]>
Received: from sincerity-forever.csail.mit.edu [128.30.67.31]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CyxAF-0001Xq-00; Wed, 09 Feb 2005 11:06:15 -0800
Received: from cananian by sincerity-forever.csail.mit.edu with local (Exim
3.36 #1 (Debian))
id 1CyxA9-0001m9-00; Wed, 09 Feb 2005 14:06:09 -0500
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: "C. Scott Ananian" <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: mozilla-firefox: Phishing vulnerability using IDN
X-Mailer: reportbug 3.7.1
Date: Wed, 09 Feb 2005 14:06:08 -0500
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: mozilla-firefox
Version: 1.0+dfsg.1-5
Severity: grave
Justification: user security hole
"Homograph attack" allows an attacker to create a link, with SSL 'lock' and
everything which is indistinguishable from a trusted site. Advisory is here:
http://www.shmoo.com/idn/homograph.txt
Example page showing this attack for paypal.com is at:
http://www.shmoo.com/idn/
and example for amazon.com is at:
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=3866526512
This last is a real shame.
There is a simple workaround for mozilla and firefox:
> You can disable IDN support in mozilla products by setting
> 'network.enableIDN' to false.
This should be done ASAP for debian packages to provide a 'secure by default'
experience. The advisory indicates that mozilla is "working on finding a
good long-term solution"; we should re-enable IDN only when that 'real'
solution appears. This fix may upset international users, but they can
locally re-enable IDN once they are advised of the vulnerability. For
english-speaking users disabling IDN is obviously the right thing to do.
--scott
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.8-2-686-smp
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages mozilla-firefox depends on:
ii debianutils 2.11.2 Miscellaneous utilities specific t
ii fontconfig 2.2.3-4 generic font configuration library
ii libatk1.0-0 1.8.0-4 The ATK accessibility toolkit
ii libc6 2.3.2.ds1-20 GNU C Library: Shared libraries an
ii libfontconfig1 2.2.3-4 generic font configuration library
ii libfreetype6 2.1.7-2.3 FreeType 2 font engine, shared lib
ii libgcc1 1:3.4.3-9 GCC support library
ii libglib2.0-0 2.6.2-1 The GLib library of C routines
ii libgtk2.0-0 2.6.2-2 The GTK+ graphical user interface
ii libidl0 0.8.3-1 library for parsing CORBA IDL file
ii libjpeg62 6b-9 The Independent JPEG Group's JPEG
ii libkrb53 1.3.6-1 MIT Kerberos runtime libraries
ii libpango1.0-0 1.8.0-3 Layout and rendering of internatio
ii libpng12-0 1.2.8rel-1 PNG library - runtime
ii libstdc++5 1:3.3.5-8 The GNU Standard C++ Library v3
ii libx11-6 4.3.0.dfsg.1-10 X Window System protocol client li
ii libxext6 4.3.0.dfsg.1-10 X Window System miscellaneous exte
ii libxft2 2.1.2-6 FreeType-based font drawing librar
ii libxp6 4.3.0.dfsg.1-10 X Window System printing extension
ii libxt6 4.3.0.dfsg.1-10 X Toolkit Intrinsics
ii psmisc 21.5-1 Utilities that use the proc filesy
ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) configu
ii zlib1g 1:1.2.2-4 compression library - runtime
-- no debconf information
---------------------------------------
Received: (at 293975-done) by bugs.debian.org; 21 Apr 2005 05:23:21 +0000
>From [EMAIL PROTECTED] Wed Apr 20 22:23:21 2005
Return-path: <[EMAIL PROTECTED]>
Received: from smtp.istop.com [66.11.167.126]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DOU9p-0005r0-00; Wed, 20 Apr 2005 22:23:21 -0700
Received: from apocalypse.kuroneko.ca (ip70-161.mtl.istop.com [66.11.161.70])
by smtp.istop.com (Postfix) with ESMTP id AECA92B3F7
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 01:25:41 -0400 (EDT)
Received: from nightcrawler.kuroneko.ca (nightcrawler.kuroneko.ca [192.168.0.3])
by apocalypse.kuroneko.ca (Postfix) with ESMTP id 5422F7C07E
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 01:23:20 -0400 (EDT)
Received: by nightcrawler.kuroneko.ca (Postfix, from userid 1000)
id 398AB198CCC; Thu, 21 Apr 2005 01:23:20 -0400 (EDT)
Date: Thu, 21 Apr 2005 01:23:20 -0400
From: Eric Dorland <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Close
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="mWXp4lmU9bb5aCfX"
Content-Disposition: inline
User-Agent: Mutt/1.5.8i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-0.4 required=4.0 tests=BAYES_00,ONEWORD,
UPPERCASE_25_50 autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--mWXp4lmU9bb5aCfX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Yeah, these have been fixed for a while.=20
--=20
Eric Dorland <[EMAIL PROTECTED]>
ICQ: #61138586, Jabber: [EMAIL PROTECTED]
1024D/16D970C6 097C 4861 9934 27A0 8E1C 2B0A 61E9 8ECF 16D9 70C6
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS d- s++: a-- C+++ UL+++ P++ L++ E++ W++ N+ o K- w+=20
O? M++ V-- PS+ PE Y+ PGP++ t++ 5++ X+ R tv++ b+++ DI+ D+=20
G e h! r- y+=20
------END GEEK CODE BLOCK------
--mWXp4lmU9bb5aCfX
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCZzjIYemOzxbZcMYRApWcAJ9pvDQGD1HzYtTbltDLcAXPPo0rIQCfQPzF
4Pc5rr/6T3ehgmOAjOD2aw0=
=1FKY
-----END PGP SIGNATURE-----
--mWXp4lmU9bb5aCfX--
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
