http://www.macworld.com/news/2005/02/08/spoof/index.php

Firefox, Safari, others struck by spoofing flaw

By John E. Dunn, Techworld.com

A dangerous spoofing security hole has been found in almost every browser on the market -- except one.

Mozilla, Firefox, Safari, OmniWeb, Opera and Netscape all suffer from the "moderately critical" vulnerability that allows the spoofing of address bar URLs and SSL certificates, but, incredibly Microsoft Corp.'s Internet Explorer gets a clean bill of health.

Publicized by security company Secunia, the flaw affect the range of browsers using the open-source Gecko browser kernel. Anyone using an affected browser would be able to visit spoofed websites without being aware of it, something that would aid any crime based on setting up bogus websites, such as phishing.

The flaw arises from the way the named browsers resolve web addresses that include international characters in International Domain Name (IDN) URLs. Russian researchers Evgeniy Gabrilovich and Alex Gontmakher first outlined the potential for such a spoofing issue in 2002, in what was then a theoretical paper, The Homograph Attack. Exploiting the hole could, they reasoned, allow them to register a "homographic" variant of http://www.microsoft.com that included Unicode/UTF-8-defined Russian characters similar to certain ASCII characters.

They speculated that some browsers would either resolve these characters in a garbled way or would, as has turned out to be the case, present them as if the registered domain was actually the real Microsoft.com. Users could also be fooled into believing the bogus site was protected by an SSL certificate when it wasn’t.

There is no patch for the vulnerability though users can at least test browsers for it on the Secunia website.

Well, I guess there is a first time for everything.

I have Firefox version 1.0 as well, and apparently I am vulnerable.

*waits for patch*

Edit: Hmmm, I could have sworn you had another post here Buggy.. heh

Well maybe I spoke too soon, I tried it on another computer with the same broweser and it did have that problem. That's totally odd.

Edit: Where did my other post go?

Firefox 1.0 on Mac OS 10.2.8 looks ok to me.
And Safari wouldn't even resolve the address with the weird character.

You didn't delete it? Weird.

I have a feeling I've been duped
Either that or I must have done something stupid and didnt know I did, which may not be far from the relm of possibilities.

Here's the Firefox fix:


Here's a site to test the fix:
http://www.shmoo.com/idn/

Well you're not being duped by me.

Thanks for the fix tommy.

Wierd, this fix worked for me a few days ago when I first applied it, but now it's not working...

It worked for me.

I got it working again.

thanks alot for the fix!!

Let me point out a few things. First, Secunia is involved (remember them? Where is peeps?).

Secondly, that is NOT a fix for Firefox. It'll work right when you switch it but as soon as you restart your browser, you're back to it not working again.

Thirdly, this isn't a flaw in Firefox, Opera, etc., it's a flaw in the standards that dictate how these browsers work. These browsers are correctly implementing the standard - for example, when Opera was contacted about this, they said they're not even going to provide a workaround because they are doing things correctly. The only reason Microsoft fared okay on this is because they're not a standards browser, the single most annoying thing to anyone who does web design (it's the reason your website can look completely screwed up in IE and not the other browsers, or vice versa).

Internet Explorer rules!

so what should be done about this problem?

*registers http://www.pearljаm.com *

According to this thread on the mozilla forum, there is a temporary workaround different from the one posted above:
________________________________________

Workaround
This can be worked around by disabling IDN support. To do this, you will have to edit compreg.dat, which is located in your Firefox profile directory (Common profile locations).

Open this file with a text editor which understands the line endings in it, such as Wordpad (or your favourite text editor on other platforms), and comment out all lines containing IDN by adding # at the start of the line. For example:



Note: you will have to repeat this edit if you install any themes or extensions, as compreg.dat gets regenerated.

thank you