troubleshooting/tutorials/security
02/07/2005, 11:35am, EST
Monday, February 7th
Security hole threatens Safari, Firefox, others
A security hole in Firefox and Safari could enable malicious Web sites to mislead users. The exploit involves International Domain Name (IDN) handling. A proof of concept is available to demonstrate the exploit. There is currently no known workaround for Safari, and a potential fix Mozilla is questioned. Internet Explorer is not affected. Camino, however, appears to be vulnerable to the exploit.
Filed under: troubleshooting
, 
, 18
, 
, 
, 
, 
Top
subscribe to comments
for this article
Enter about:config in the address bar and click Go or hit Enter.
Scroll down to the network.enableIDN preference and double-click so the value is says "false".
The problem is that the setting will be ignored the next time Firefox is started and will have to be reset each time the browser is launched (even if the pref says "false").
This is a pure abuse and disregard of the rules set for IDN handling, where top-level registrars are supposed to be as restrictive as possible in handing out IDN coded domain names. Of course, the ICANN turns a blind eye on the .com, .net and .org TLDs, opening up a can of worms in regard to phishing. Other TLDs are supposed to stick with their alphabet only to minimise problems, but some TLDs have not honoured this ( like Poland f.ex. - they would happily register "ibm·com.pl" - see a possible conflict with "ibm.com.pl" ? :)
http://www.shmoo.com/idn/homograph.txt
Notice the timeline at the end of the document. They reported the problem to the vendors January 19, 2005, and published details of the exploit yesterday (February 6). Does security etiquette call for more time than that? I thought at least 60 days was the norm.