[Security] Uninstall Greasemonkey!

NetRyder

Tech Junkie
Joined
19 Apr 2002
Messages
13,256
If you're using the Greasemonkey extension for Firefox, you should remove it until an updated version has been released. Bear in mind that this flaw affects all Firefox users who use the Greasemonkey extension, regardless of what OS they're using.

A serious… no, make that critical flaw has been discovered in Greasemonkey that allows an attacker unfettered access to your system. From the Mozilla discussion thread:

“But wait, it gets worse. An attacker doesn’t even need to know the exact filename, since “GET”ting a URL like “file:///c:/” will return a parseable directory listing. (And Mac users don’t get to gloat either; you’re just as vulnerable, starting with a different root URL.) In other words, running a Greasemonkey script on a site can expose the contents of every file on your local hard drive to that site.

Running a Greasemonkey script with ”@include *” (which, BTW, is the default if no parameter is specified) can expose the contents of every file on your local hard drive to every site you visit. And, because GM_xmlhttpRequest can use POST as well as GET, an attacker can quietly send this information anywhere in the world.”
Hat tip to Marc Orchant
 

Members online

No members online now.

Latest profile posts

Also Hi EP and people. I found this place again while looking through a oooollllllldddd backup. I have filled over 10TB and was looking at my collection of antiques. Any bids on the 500Mhz Win 95 fix?
Any of the SP crew still out there?
Xie wrote on Electronic Punk's profile.
Impressed you have kept this alive this long EP! So many sites have come and gone. :(

Just did some crude math and I apparently joined almost 18yrs ago, how is that possible???
hello peeps... is been some time since i last came here.
Electronic Punk wrote on Sazar's profile.
Rest in peace my friend, been trying to find you and finally did in the worst way imaginable.

Forum statistics

Threads
62,015
Messages
673,494
Members
5,621
Latest member
naeemsafi
Back