An error in the way in which the Firefox and Opera browsers handle image files could allow an attacker to export a user’s web history or crash the Firefox browser, according to advisories from a Polish researcher and The United States Computer Emergency Readiness Team (US-CERT).
The vulnerability is caused by the manner in which the two browsers handle a bitmap image file (.bmp), according to a warning posted by Polish researcher Gynvael Coldwind of Vexillium.org. Coldwind also posted a video illustrating the problem.
According to Coldwind, an attacker can create a malicious bitmap file that extracts information from the browsers’ memory. Some of the stolen data is randomly collected, but the attack also could collect valuable data, the advisory noted.
“The harvested data contains various information, including parts of other websites, users’ favorites and history, and other information,” Coldwind said on Vexillium.org.
“This has been tested [and] a proof-of-concept exploit has been created,” Coldwind said. However, he added that the exploit has not yet been released.
The vulnerability could also cause Firefox to crash. The flaw affects Firefox 220.127.116.11 and previous versions, as well as the beta version of Opera 9.50.
“Other browsers – [such as] Apple Safari – contain vulnerable BMP handling code,” Coldwind noted in his report. “But since there is no way of acquiring the image data, it doesn’t pose a serious threat. Then again, maybe the attacker could convince the user to do a screenshot and send it to [him].”
Coldwind said the Apple Safari browser “has a similar problem with certain GIF files.”
In its advisory, US-CERT encouraged Mozilla Firefox users to upgrade to Firefox 18.104.22.168 and Opera users to upgrade to Opera 9.25.
Most Opera users are not vulnerable to the flaw because it was patched in version 9.25, released in December, Opera spokesman Thomas Ford told SCMagazineUS.com.
In addition, Opera 9.26 was released Wednesday, Ford said. Users are advised to upgrade to the latest version.