User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1 Build Identifier: N/A Note: This bug was originally reported to IPA (Information-technology Promotion Agency, Japan) and forwarded to us at Mozilla Japan. I'm NOT original reporter. Don't mention my name in the security advisory. For more information about IPA, visit http://www.ipa.go.jp/about/english/ JVN28513736 Attackers can forge a Web page on another domain by sending the HTTP response including "Content-Length" header and "Transfer-Encoding: chunked" header. This could be used for the real phishing to steal sensitive data, such as user password or cookies. Windows XP Professional SP2 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060129 Firefox/1.6a1 Reproducible: Sometimes Steps to Reproduce: 1. Set up Firefox to use Squid/2.5.STABLE12 for HTTP proxy 2. Configure Squid. Set the value of "persistent_request_timeout" to "1 minute". 2. Provide the proxy with HTTP response with the following conditions: A. "Content-Length" header is included B. "Transfer-Encoding: chunked" is included C. response length with chunk size data of B is shorter than the value of A Actual Results: Squid conforms to HTTP/1.0, not to HTTP/1.1. Therefore, It will send data of the number of bytes specified by Content-Length header to the browser. Transfer-Encoding header with a space will be transferred as is. This is appropriate behavior compliant with HTTP/1.0. Firefox will receive the response via proxy and handle the response body based on Transfer-Encoding header. Firefox determines the termination of message body based on the last chunk of chunked encoding, not Content-Length. The rest of response determined by the condition C is incorrectly recognized as the response of following HTTP request. Expected Results: The rest of response should not be recognized as the response of following HTTP request. Additional Information: The malicious Web site admins can target Firefox users who use HTTP proxy (that keep-alive anabled) to steal cookies or build web pages including fake login form for arbitrary domains. Original reporter says that Firefox doesn't ignore the header that isn't part of HTTP/1.0 (but is defined by HTTP/1.1) when it interprets HTTP/1.0 response. Although this report makes an issue of Transfer-Encoding header, but other headers might be a problem. Reporter also says Firefox should be implemented not to reuse stream that is connected to the HTTP proxy when it starts connection to another web server. Workaround for Squid admins: disable keep-alive

IPA send us the data flow chart. I attach it.

Any updates?

So, I think that if we get a HTTP/1.0 response, we should favor a Content-Length header of a Transfer-Encoding header. I worry that ignoring Transfer-Encoding headers entirely will result in incompatibilities. I need to check what IE does.

IE6 seems to correctly ignore the "Transfer-Encoding: chunked" header when included in the response from a HTTP/1.0 server. So, we can easily do the same.

Here's a simple python script that demonstrates the bug. Load http://host:4444/ twice and if you get a popup that says "hacked" then you're browser is vulnerable.

Make us behave like IE6.

but what does IE6 do when the version is 1.1 and the situation is otherwise the same? put differently, doesn't this just require changing the attack to use a 1.1 version?

> but what does IE6 do when the version is 1.1 and the situation is otherwise the > same? put differently, doesn't this just require changing the attack to use a > 1.1 version? You're asking what if the proxy server spoke 1.1? Then, the proxy server would not be fooled into forwarding the embedded response, and the exploit wouldn't exist. My python testcase is not an exact replica of the actual exploit in that it is not a proxy server. It just demonstrates the same underlying problem.

fixed-on-trunk

Comment on attachment 217165 [details] [diff] [review] v1 patch a=jay for drivers, please get this on the 1.8.0 branch. Thanks!

fixed1.8.1

fixed1.8.0.3

v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060420 Firefox/1.5.0.2, no "hacked" popup with Darin's python script testcase. Kohei: If you want to also verify this bug and the other http header fixes with your proxy setup, please do so and let us know if things look ok. Thanks!

IPA have confirmed that this vulnerability affects Firefox only. It's OK to publish security advisory as of Firefox 1.5.0.4. Thanks!

IPA told us that the original reporter is Kazuho Oku (Cybozu Labs). FYI: http://labs.cybozu.co.jp/en/archives/2005-08-16-1.html dveditz: Please mention his name in the upcoming advisory.

a proposed backport.