CVE-2010-0170

Vulnerability

In Firefox 3.6, the window.location object was made a normal overridable JavaScript object as part of new same-origin policy enforcement mechanisms. This object is used by some plugins to determine the page origin for access restrictions. A malicious page can override window.location to fool a plugin into granting access to data on another site or the local file system. This flaw affects Firefox 3.6 before version 3.6.2 and does not affect earlier versions or other Mozilla products like Thunderbird or SeaMonkey [1][2].

Exploitation

An attacker must host a malicious web page that overrides the window.location object. When a plugin (e.g., Flash) queries this object to enforce its own same-origin checks, it receives a fake origin. The attacker can then craft plugin-specific vectors to bypass the Same Origin Policy and perform cross-site scripting (XSS) attacks [1][2].

Impact

Successful exploitation allows an attacker to bypass the Same Origin Policy, potentially leading to cross-site scripting (XSS) attacks or unauthorized access to data on other sites or the local file system, depending on the plugin's capabilities [1].

Mitigation

The vulnerability is fixed in Firefox 3.6.2, released on March 23, 2010. Users should upgrade to Firefox 3.6.2 or later. No workarounds are documented in the available references [1].