Greasemonkey Flaw Prompts Critical Uninstall Warning

A very serious security vulnerability has been flagged in the popular Firefox browser add-on, and Greasemonkey users should immediately uninstall the program.

A gaping security hole in a popular Firefox browser extension could allow malicious hackers to hijack files from a users hard drive, developers warned Tuesday.

The vulnerability was flagged in Greasemonkey, the Firefox add-on that allows users to load custom scripts that modify Web sites on the fly.

The flaw is so serious that developers are warning users to completely uninstall Greasemonkey versions prior to 0.3.5.

Mark Pilgrim, an XML coder who helped to evangelize the extension with the free "Dive into Greasemonkey" e-book, has published working exploits to highlight the severity of the flaw.

In a series of posts to the Greasemonkey mailing list, Pilgrim warned that the published exploits are "much, much worse" than first imagined, noting that a successful attacker could hijack any world-readable file from a vulnerable computer.

Read details here about Mozillas Firefox marketing site being hacked.

"An attacker doesnt even need to know the exact filename," he said, noting that a certain exploit would return a parseable directory listing.

"In other words, running a Greasemonkey script on a site can expose the contents of every file on your local hard drive to that site," Pilgrim said.

Resource Library:

He added that certain Greasemonkey scripts can be exploited to expose the contents of every file on a users local hard drive to every site that user visits, and that an attacker "can quietly send this information anywhere in the world."

Click here to read about the latest Firefox security updates.

Greasemonkey users are strongly advised to uninstall the extension completely or downgrade to Greasemonkey 0.3.5, which is described as a "neutered" version of Greasemonkey.

"I have heard no reports of this flaw being exploited, but now that its public knowledge it isnt safe to continue using any version of Greasemonkey other than 0.3.5. Please either upgrade to 0.3.5 or disable Greasemonkey until I can get a fix finished," Pilgrim said.

"At this point, I dont trust having it on my computer at all. I would think that whoever is in charge of addons.mozilla.org should immediately remove the Greasemonkey XPI and post a large warning in its place advising people to uninstall it," he added.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Reader Comments: Greasemonkey Flaw Prompts Critical Uninstall Warning >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine