Risk: High
A serious cross-platform security flaw has been found in a popular extension for the open source browser.
The developer of Greasemonkey is making an update for a critical security flaw in his extension to the Firefox browser available via the Mozilla website.
Greasemonkey is a popular add-on used to customise the design and behaviour of Web pages. The flaw could let attackers read any file on a user's local hard drive and list the contents of local directories. The update, Greasemonkey 0.3.5, was released on 18 July, according to the download page on the Mozilla Foundation's Web site. The Mozilla Foundation coordinates Firefox development and marketing.
The flaw affects versions of Greasemonkey prior to 0.3.5, including early 0.4 alphas, according to a posting on Mozdev.org, a site where developers post applications and add-ons.
People who switch to version 0.3.5, however, will find it lacks the so-called GM* APIs, which are designed to make Greasemonkey more powerful than HTML, according to a Greaseblog posting, a blog devoted to the extension. As a result, scripts that rely on these APIs will fail with the 0.3.5 version. "Greasemonkey 0.3.5 is a 'neutered' version of Greasemonkey," said a developer in a post to the blog.
The vulnerability affects PCs and Macs and means a hacker does not need to know an exact file name before diving into a system. According to one online posting, typing something such as "file:///c:/" will return a parseable directory listing. Macs can be hacked in a similar way.
Greasemonkey enables developers to add DHTML to a web page, in order to change that page's behavior. The vulnerability is caused due to certain functions being insecurely exposed and can be exploited by a malicious web site via the "GM_xmlhttpRequest()" function to disclose the contents of arbitrary local files and list the contents of arbitrary local directories.
Users have been advised to either completely un-install the Greasemonkey extension or downgrade to Greasemonkey to 0.3.5 - a "neutered" version that lacks the APIs making Greasemonkey scripts more powerful than regular HTML until a fix is produced.