Bug 476274 (CVE-2008-5505) - CVE-2008-5505 Firefox 3 User tracking via XUL persist attribute
Summary: CVE-2008-5505 Firefox 3 User tracking via XUL persist attribute
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-5505
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-12-12 20:40 UTC by Josh Bressers
Modified: 2019-09-29 12:28 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-12-25 16:58:39 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:1036 0 normal SHIPPED_LIVE Critical: firefox security update 2008-12-17 01:32:17 UTC

Description Josh Bressers 2008-12-12 20:40:26 UTC 
Security researcher Hish reported that the persist attribute in XUL
elements can be used to store cookie-like information on a user's computer
which could later be read by a website. This creates a privacy issue for
users who have a non-standard cookie preference and wish to prevent sites
from setting cookies on their machine. Even with cookies turned off, this
issue could be used by a website to write persistent data in a user's
browser and track the user across browsing sessions. Additionally, this
issue could allow a website to bypass the limits normally placed on cookie
size and number.
Comment 2 Josh Bressers 2008-12-16 23:16:45 UTC 
This is now public:
http://www.mozilla.org/security/announce/2008/mfsa2008-63.html
Comment 3 Fedora Update System 2008-12-21 08:29:26 UTC 
xulrunner-1.9.0.5-1.fc10, firefox-3.0.5-1.fc10, epiphany-2.24.1-3.fc10, epiphany-extensions-2.24.0-3.fc10, blam-1.8.5-5.fc10, devhelp-0.22-2.fc10, evolution-rss-0.1.2-3.fc10, galeon-2.0.7-4.fc10, gecko-sharp2-0.13-3.fc10, gnome-python2-extras-2.19.1-25.fc10, gnome-web-photo-0.3-13.fc10, google-gadgets-0.10.3-2.fc10, kazehakase-0.5.6-1.fc10.2, Miro-1.2.7-3.fc10, mozvoikko-0.9.5-5.fc10, mugshot-1.2.2-4.fc10, pcmanx-gtk2-0.3.8-4.fc10, ruby-gnome2-0.18.1-2.fc10, yelp-2.24.0-4.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2008-12-21 08:36:01 UTC 
xulrunner-1.9.0.5-1.fc9, firefox-3.0.5-1.fc9, epiphany-2.22.2-6.fc9, epiphany-extensions-2.22.1-6.fc9, blam-1.8.5-4.fc9.1, cairo-dock-1.6.3.1-1.fc9.2, chmsee-1.0.1-7.fc9, devhelp-0.19.1-7.fc9, evolution-rss-0.1.0-5.fc9, galeon-2.0.7-4.fc9, gnome-python2-extras-2.19.1-22.fc9, gnome-web-photo-0.3-16.fc9, google-gadgets-0.10.3-2.fc9, gtkmozembedmm-1.4.2.cvs20060817-24.fc9, kazehakase-0.5.6-1.fc9.2, Miro-1.2.7-3.fc9, mozvoikko-0.9.5-5.fc9, mugshot-1.2.2-4.fc9, ruby-gnome2-0.17.0-4.fc9, totem-2.23.2-9.fc9, yelp-2.22.1-7.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Vincent Danen 2010-12-25 16:58:39 UTC 
This was addressed via:

Red Hat Enterprise Linux version 4 (firefox) RHSA-2008:1036
Red Hat Enterprise Linux version 5 (firefox) RHSA-2008:1036
Note You need to log in before you can comment on or make changes to this bug.