An error in the way in which the Firefox and Opera browsers handle image files could allow an attacker to export a user's web history or crash the Firefox browser, according to advisories from a Polish researcher and The United States Computer Emergency Readiness Team (US-CERT).
The vulnerability is caused by the manner in which the two browsers handle a bitmap image file (.bmp), according to a warning posted by Polish researcher Gynvael Coldwind of Vexillium.org. Coldwind also posted a video illustrating the problem.
According to Coldwind, an attacker can create a malicious bitmap file that extracts information from the browsers' memory. Some of the stolen data is randomly collected, but the attack also could collect valuable data, the advisory noted.
"The harvested data contains various information, including parts of other websites, users' favorites and history, and other information," Coldwind said on Vexillium.org.
An attacker can capture the data using the "canvas" HTML tag supported by the two browsers, the advisory explained. Then, via JavaScript, the information can be sent to a remote server.
"This has been tested [and] a proof-of-concept exploit has been created," Coldwind said. However, he added that the exploit has not yet been released.
The vulnerability could also cause Firefox to crash. The flaw affects Firefox 2.0.0.11 and previous versions, as well as the beta version of Opera 9.50.
"Other browsers – [such as] Apple Safari – contain vulnerable BMP handling code," Coldwind noted in his report. "But since there is no way of acquiring the image data, it doesn't pose a serious threat. Then again, maybe the attacker could convince the user to do a screenshot and send it to [him].”
Coldwind said the Apple Safari browser "has a similar problem with certain GIF files."
In its advisory, US-CERT encouraged Mozilla Firefox users to upgrade to Firefox 2.0.0.12 and Opera users to upgrade to Opera 9.25.
Window Snyder, the Mozilla Foundation's chief security officer, told SCMagazineUS.com that the problem has been corrected in 2.00.12. Mozilla recommends that users remaining on previous versions of Firefox disable JavaScript until they upgrade to the latest version. A Mozilla security advisory (2008-07) describes the issue.
Most Opera users are not vulnerable to the flaw because it was patched in version 9.25, released in December, Opera spokesman Thomas Ford told SCMagazineUS.com.
In addition, Opera 9.26 was released Wednesday, Ford said. Users are advised to upgrade to the latest version.
