Tabbed browsing, one of the more popular features built into
alternative Web browsers, contains a security flaw that puts users at
risk of spoofing attacks, research firm Secunia warned on Wednesday.
Secunia released an advisory
detailing the flaws, which affect users of Mozilla,
Mozilla Firefox, Netscape, Opera, Camino, Konqueror, Avant Browser and
Maxthon (MyIE2).
The flaws target the tabbed browsing feature, which lets surfers
view multiple Web sites in a single browser session.
According to
Secunia, the first bug makes it possible for an inactive tab to spawn
dialog boxes even if the user is viewing a different Web site
in another tab.
The browsers don’t indicate which tab
launched the dialog boxes, according to Secunia. This could lead the user into
disclosing information to a malicious Web site or to download and run a
program, which the user thought came from another trusted Web site, the
company warned.
Mozilla 1.7.3,
Mozilla Firefox 0.10.1, Camino 0.8, Opera 7.54, Konqueror 3.2.2-6,
Netscape 7.2, Avant Browser 9.02 build 101, Avant Browser 10.0 build 029
and Maxthon (MyIE2) 1.1.039 are the browser versions susceptible to this flaw.
A demonstration of this vulnerability has been posted online.
A second vulnerability also makes it possible for an inactive tab to
always gain focus on a form field in the inactive tab, even if the user
is viewing a different Web site in another tab,
Secunia said.
“This is escalated a bit by the fact that most people do not look at
the monitor while typing data into a form field, and therefore might
send data to the site in the inactive tab, instead of the
intended/viewed tab,” the company added.
A demonstration
illustrates how users of the following browsers were at
risk: Mozilla 1.7.3,
Mozilla Firefox 0.10.1, Netscape 7.2, Avant Browser 9.02 build 101,
Avant Browser 10.0 build 029 and Maxthon (MyIE2) 1.1.039.
Secunia’s severity ratings for the flaws vary from “moderately
critical” to “less critical” depending on the browser. The company
recommends that users avoid visiting trusted Web sites when tabs are
open with pages of untrusted sites.
Alternatively, users are urged to disable JavaScript until vendor
fixes are made available.
