Date: Fri, 20 Oct 2023 18:21:18 +0300 From: Turistu <turistu@...il.com> To: oss-security@...ts.openwall.com Subject: Re: with firefox on X11, any page can pastejack you anytime On Fri, Oct 20, 2023 at 03:27:41PM +0200, Solar Designer wrote: > On Tue, Oct 17, 2023 at 03:17:36AM +0300, turistu wrote: > > In firefox running on X11, any script from any page can freely write to the > > primary selection, and that can be easily exploited to run arbitrary code > > on the user's machine. > > What about other web browsers running on X11, most notably Chrome and > Chromium? They're safe from *this* particular issue, which is caused by a simple bug deep inside mozilla's C++ code, not by some explicit design decision. > If the issue is unique to Firefox or at least not universal > across browsers, that's an extra reason for Firefox to make a change. > > On Fri, Oct 20, 2023 at 02:10:06AM +0300, Turistu wrote: > > OK this was probably too technical and terse for people not familiar > > with X11 programming and terminology, so thing goes like this: > > > > 1. If you're a user who has first learned to use a GUI on e.g. Windows, > > and who is used to copy & paste with Ctrl-C Ctrl-V (or with left-click, > > choose Copy from the menu, and then again left-click, choose Paste), > > then congratulations! this DOES NOT AFFECT YOU. > > > > (Unless you're using some clipboard tools which merges the primary and > > clipboard selection, but I guess you don't ;-)) > > > > 2. But if you're a *native* X11 user who is used to just select the text and > > then paste it with a middle-click or shift-Insert, then this means you're > > pretty much done, and you should immediately either stop using firefox or > > try the workaround and patch described in my report. This also includes > > Wayland users. > > Or isolate Firefox to its own X server (or at least a separate one from > where you run terminal emulators managing important stuff), like it > happens when you run it in its own VM (or perhaps many instances of it > in many VMs) on Qubes OS. Indeed this also removes the convenience of If you do that, notice that you will also have to run a window manager inside that separate X server, because firefox (which never implemented the X11 and icccm protocols correctly) needs a wm in order to function properly (more precisely a point-to-focus wm or one that simulates point-to-focus just to keep firefox and some other horrors like old atk java apps happy).
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.