Yesterday, Mark Pilgrim discovered and announced a very serious security vulnerability in Greasemonkey. The flaw allows any website which matches at least one user script (even * scripts) to read any local file on your machine, or to list the contents of local directories. The flaw applies to Greasemonkey on all platforms.
I'm working feverishly on a fix for this. But this will take several days. In the meantime, I strongly recommend that everyone either install Greasemonkey 0.3.5, or else disable or uninstall Greasemonkey completely.
Greasemonkey 0.3.5 is a "neutered" version of Greasemonkey, lacking any of the GM* APIs which make Greasemonkey scripts more powerful than regular HTML. This means that scripts which depend on GM* APIs will fail with Greasemonkey 0.3.5.
I have heard no reports of this flaw being exploited, but now that it's public knowledge it isn't safe to continue using any version of Greasemonkey other than 0.3.5. Please either upgrade to 0.3.5 or disable Greasemonkey until I can get a fix finished.
I'm aware of how badly this sucks for many of you. Please accept my deepest personal apologies and realize that I'll do my best to get a fixed Greasemonkey available just as soon as possible.
If you have any other questions, the Greasemonkey mailing list is a good place to ask them.
Tuesday, July 19, 2005
Mandatory Greasemonkey Update
74 comments:
I'd say : bugs happen, Greasemonkey is truly awesome and a hint of the future and you shouldn't be apologizing. The bleeding edge of the web can cut :-)
I'll be looking forward for the fixed release. Thanks for your awesome and inspiring work.
Dude,
S#!t happens! No need to apologize. We all know that this is bleeding edge + the good thing to know is that the distributed innovation model - works suprememly for bug catching!
Keep up the good work!
Man, you can't see every result of every permutation of every function of a powerful toolkit... You keep rocking, and we appreciate you also taking so much care of this bitchin device we all love!
Good luck!
Will it be possible for Greasemonkey to use the more powerful APIs only if the script came from the local drive?
Could you explain a bit more as to what happens.
i.e. Does this happen on default or only cetain scripts that *leak* GM* API's? If so, how can we tell if a script leaks API's, and how do you prevent it?
Thanks.
Does this happen whether one is running Windows or a Mac? I assume that makes no difference, but still I ask ....
The exploit can happen on any page where a greasemonkey script is enabled. If you have a global GM script, then ANY web site out there can exploit the flaw by accessing the GM object. If you have only site-specific GM scripts, then only those allowed sites can exploit the flaw. If you trust those sites, then you are probably safe.
YOU SUCK I GOT HACKED IN AND THEY STOLE MY FRIDGE.
Question: the main site says that it affected EARLY betas of Greasemonkey 0.4. I'm however using the one from like two days ago, linked to here:
http://www.mozdev.org/pipermail/greasemonkey/2005-July/003962.html
I'm I still affected?
Thanks in advance.
So how do I find out what version I'm running?
Ugh. Sucks man. keep us posted re: the fix. I've only been using GreaseMonkey for a couple of weeks and this sure did make me realize how much I've been leaning on it.
Regarding which 0.4's -- interpret "early versions" as all versions which exist right now. The one you have is afflicted. Sorry for the confusing language :-). I meant early as in, not even betas -- earlier than beta -- stuff that was floating around the mailing list.
You can find out what version you have by going to tools > extensions. It's next to the Greasemonkey title.
firefox sux
extensions sux
go with the best
ms
wellcome to the mases =o)
As far as I can see, it's only the GM_xmlhttpRequest API that is dangerous, and frankly, I don't see why it needs to be present, nor am I aware of any user scripts that use it. The existing XMLHttpRequest is all the scripts should need, why provide another less secure version?
Anyway, the point is, can't you remove just this API, instead of all of them?
Looks like you're over-reacting. Is there any way to exploit the other APIs that has not been mentioned? Please provide some more details.
The GM_xmlhttpRequest API is very useful and I have used it for my scripts. It allows you to mix content from different sites. The regular xmlhttpRequest has a same-origin policy, which limits its utility significatly.
grnch,
Book Burro is a good example of a script using GM_xmlhttpRequest. There are more. Here are some:
http://bje.nu/download/greasemonkey/ljuserinfolastpost.user.js
http://brainoff.com/geocoder/gmaps.user.js
amazon2melvyl.user.js
annotate_google.user.js
bloglines.user.js
deliscrobbler.user.js
flick_batch.user.js
foaf-discovery.user.js
foxietb050430dus.user.js
gmaps.user.js
google_ad_prefetch.user.js
hattrick.user.js
hide-google-redirects.user.js
indiantimes.user.js
LibraryLookup.user.js
ljuserinfolastpost.user.js
mypipstag.user.js
riaa.user.js
http://greg.vario.us/software/foaf-discovery.user.js
http://hublog.hubmed.org/files/google_ad_prefetch.user.js
http://members.iinet.net.au/~lachiec/greasemonkey/flick_batch.user.js
http://persistent.info/greasemonkey/bloglines.user.js
http://ponderer.org/download/annotate_google.user.js
http://s89790145.onlinehome.us/code/greasemonkey/worldcatreal.user.js
http://sims.berkeley.edu/~ryanshaw/amazon2melvyl/amazon2melvyl.user.js
http://weblog.infoworld.com/udell/gems/LibraryLookup.user.js
http://www.cs.toronto.edu/~james/greasemonkey/hide-google-redirects.user.js
The usual xmlhttpRequest that's available is confined to requests on the same domain. GM_xmlhttpRequest allows requests to any domain, which allows cross-site integration and stuff like personal proxies and annotations. Think Google Search that you roll on your own there.
As for overreacting, not so. This is a very severe exploit. It was important that a version without the exploit be immediately available, and that it be distributed as widely as possible. Breaking scripts is a small thing compared to opening up local files.
Aaron's been working on a new version that fixes the exploit and keeps compatibility. Delaying a fix on this for even a day would have been negligent. 0.4 is coming soon, and we'll all be happier for it.
Anyone who says that apologizing isn't necessary is simply an ass-kisser. To apologize is merely to admit fault--and how can he not?
Before the cry babies turn red, realize that I'm not criticizing the author. He did the right thing.
On the other hand, I am glad I never saw fit to use Greasemonkey!
The problem is that GM_xmlhttprequest
can get at local files. That should
be simple to fix, right? IMHO that
should never have been allowed in
the first place.
Anyway, tis an unfortunate headline
on /.
Lookin forward to the next version.
Thanks for the warning. The people of deviantART have been notified. *salute*
We also use the GM_xmlhttpRequest API a lot inside our application, because of the single domain limitations of the xmlHttpRequest API.
It would be very sad to see this function removed from GM !
It needs to be fixed for the local files exploit, but its ability to do GET/POST from other domains is definitely a must-have!
Curious, but are GM user scripts injected into a webpage any differently than bookmarklets?? Wser scripts and bookmarklets both seem to share a common trait of acting on a webpage's content but also being able to access functionality not available to the webpage. In the case of user scripts it's the GM_ functions, in the case of bookmarklets it's access to chrome urls. If the two are implemented differently, then perhaps the user scripts should be implemented more like bookmarklets. Just a thought, I don't know what's going on under the hood.
Good Luck on the patch. Losing the GM_ special functions for now is no big deal, most of the script I use do not need them, and those that do more than likely are suffering from feature bloat anyways :) Back to the basics of what GM was all about.
No worries. I've uninstalled it for now and can easily put it back when the time comes. I appreciate the effort you put into Greasemonkey and fixing major bugs.
Keep up the great work, re the bug, well they happend. You've handled this exactly as you should!
Thanks!
Amazing how much I got used to it!Without noticing I got used to surfing without ads(90% of the time, looking forward to the new version!
Using the NoScript extension makes this GreaseMonkey vulnerability practically unexploitable. NoScript forbids all JavaScript activity happening in content (including GreaseMonkey user scripts and "rogue pages" that would attempt to exploit the GM_* API), except for URI that you explicitely flag as "trusted" (e.g. your web mail, your bank account or your preferred news site).
No need to apologise! Keep rocking! If I wasn't so crap at Javascript I'd offer to lend a hand... but...
itub & jeremy dunck: I didn't know about all those scripts, thanks for pointing them out. Still, there was a reason for limiting the original XMLHttpRequest to a single domain, which this debacle with GM_XMLHttpRequest finely illustrates.
Fixing it to reject requests for local files will not be enough, I'm affraid, because it could also be used to make requests to hosts on the LAN (inside the firewall), which can contain potentially sensitive information, and there is no easy way to determine which hosts should be considered local.
The only true fix would be to make the GM_* functions completely inaccessible to any javascript code coming from the net.
Also, to clarify, the overreaction I was referring to consisted in removing ALL the GM_* functions from 0.3.5, when only removing GM_xmlhttprequest would have sufficed. The other GM APIs don't seem vulnerable. Or am I missing something?
I think any of the GM functions could be accessed by a website owner. So they could also potentially play with your greasemonkey settings using GM_setValue/_getValue.
Sure most scripts don't have anything sensitive in those areas, but it could be annonying if a malicious website owner set all our Greasemonkey script settings to something else. Or at least that's my understanding of it...
Flickr implemented a Greasemonkey vulnerability detection script on all their pages. How cool is that. Check it out. Others should/might do it also.
GM_xmlhttprequest is a critical function we are using in our research for user interfaces.
We look forward to having the functionality restored as soon as possible! :) Pleeeaase!
Hi, I've translated Greasemonkey to Basque (Euskara). If you wish, I can send you the xpi in order to put it on your website. Please reply to 3arranoAT3arranoDOTcom.
Thanks
The sooner the fix the better... I'm getting tired of seeing such a sad little monkey face in my status bar... lol... all jokes aside thanks for being upfront with the problem rather than hiding behind it all. I'm not mentioning names or anything, *cough* IE *cough*.
Anything worth doing is worth doing wrong till you can get it right. Greasemonkey is like that. I've put a remander to check everyday till your next shot. Thanks for your hard work a I'll be here, waiting.
D, AKA The Webster
This incident is a very serious indication that Firefox is not really suitable for Corporate environments.
Mutchibara Nihonkawa,
Japan
I am very hacked
I would like to point out that corporate environments vendor choices suffer the same problems in the software development cycle as does Firefox. The key difference is, like in this case, there is the good ethics and morality present to do this kind of thing. I would much rather have bad news than to think everything is working while running a ticking time bomb... Thanks very much for doing the right thing and taking the high path.
On corporate environments you would most likely not have users installing scripts like greasemonkey. For crissakes there is a tiny minority that even bother to install extensions.
>>>
This incident is a very serious indication that Firefox is not really suitable for Corporate environments.
Mutchibara Nihonkawa,
Japan
<<<
IE sure as wicca is evil is certainly unsuitable for any environment. Firefox is the best thing since pickled beets.
Actually, as I said in a comment to another thread I would like people inside my company (IBM) to actually find it easier to wind up with Firefox installed with GreaseMonkey and selected scripts. That puts the onus, IMHO, on those selected scripts. Which isn't the same as having them install any old script they stumble across on the web.
So I do think it is suitable for a corporate environment - once the security issues are sorted out.
please post the link to the new 0.4.1 alpha!
Is there a possibility to disable this annoying warning which pops up at every page when Greasemonkey is used? I disabeld all scripts but two for a site I feel sure with. So I don't want to see this warning on every page of this site.
It is truly ignorant to think this security flaw in GreaseMonkey reflects negatively on Firefox. Anyone can write an insecure plug-in for ANY browser. That does not mean you blame the browser for being insecure. So anyone that uses this flaw to say people should use IE instead are just plain ignorant, and should be ignored.
Anonymous#2-- why is one bashing and making a big deal about the Greasemonkey,Firefox and IE. Even so that IE may have many loopholes. it's a matter of choice of which ones to use. I of course perfer firefox over IE but when it comes to mac.. Even so I use Both Firefox and Safari.. There is bound to be one software to be new crazed or BEst there is then comes a hole or a problem then we kicked it to the curb. Example how many of us out there can really program these type of softwares? yet we kicking it to the curb? so dude the one that made this greasemonkey keep up the GREAT work with since I find those who are patient in learning how to wrote programs are the coolest gift one can have.
This file:///c:/ seems to work with IE v6 as well
well, when it works the program is great! So just keep on working on keeping it secure and great
No need to apologize dude!... Buena Suerte!
achat dvd viergeachat dvdachat mp3autoradio dvdautoradio mp3baladeur mp3boitier dvdcd musiquechanson francaisechanson paillardeparole chansonhoroscope poissonhoroscope sagittairehoroscope scorpionhoroscope taureauhoroscope verseauhoroscope viergehoroscopehoroscope lionhoroscope gemeaujeu de tarottarotzodiaquelogiciel comptablelogiciel de dessinlogiciel de gravuretelechargement logiciellogiciel de traductionlogiciel gratuitlogiciel montage photologiciel montage videologiciel mp3logiciel gratuitlogicielneroecran de veillefond d ecran ordinateurecran de projectionecran veilleecran plasmaecran de veille gratuitemoticone gratuitemoticonefond d ecran animalfond d ecran gratuitfond d ecran ordinateurfond d ecran pcfond ecran portabledivxdivx gratuitdivx playerdownload accedonkey 2000edonkeyemule fremule franceemule gratuitemule maniaemule paradiseemulefond d ecran sexyfond cranfond d ecran animalfond d ecran gratuitfond d ecran ordinateurfond ecran pcfond ecran sexyfond d ecranfondiconeicone xpillustrationimagefilm dvdfilm divxfrancaise des jeufrance musiquegraveur dvd externegraveur dvdinstrument de musiquejacquette dvdjaquette divxjaquette dvdlecteur divxaperitifchef recettecuisinerecette de cuisineporcpouletrecetterecette cuisinesoupe aux chouparole de chanson anglaispartition de musique pour pianopartition gratuite flute traversierelot partition tablature guitare beatlespartition de piano d amelie poulainpartition chanson francaiseDoes Your Mother KnowSlow Turningtablature guitare gratuite ille vilainetablature harmonicamsn plusnouvelle version msntelechargement msn messenger 7.5telecharger msn 7.5telecharger msn messenger 7.5telecharger msn messenger 8.0telecharger msn messenger gratuitementtelecharger msn messenger plustelecharger msn web messengertelecharger msntelecharger msnlecteur dvd divxlecteur dvd portablelecteur dvddriver pour lecteur dvd pioneerlogiciel lecture dvdlecteur mp3 baladeurlecteur baladeur mp3 usbtelechargement musique mp3musiquemusique a telechargemusique alsaceastuce jeu videoastuce jeu videoastucecasino jeucode jeuconsole de jeujeu a grattertelecharger jeujeu actionjeu adultejeu arcadeaccessoire voitureautomobilecode jeutuning motoparis tuning show 2006paris tuning showrallytuningvoiture tuningvoiturenero burningnero expresspack codecpiloteripperserveur emuleshareazaskypetelechargement p2ptelechargement logicieljeu de combatjeu de damejeu de footjeu grattage gratuitjeu hasardjeu de lulujeu de motojeu de rolejeu de strategiejeu de stylistejeu de voiture gratuitchanson pour enfantclip musiquecodec divxtelecharger codec windows media playercodeccombi dvd vhsconvertir wave en mp3copie dvddriverdriver hpdvd divxbanque postalecarte postale virtuellecarte postalehennemodèle de tatouagepiercing languepiercing nombrilpiercingtatootatouagemusique arabemusique classiquemusique countrymusique de filmmusique gratuitemusique gratuite a telechargerparole chansonparole de chanson francaiseparole et musiqueparole et musiqueparole chansonlogiciel antivirustelecharger jeuantivirus personalantivirus gratuitantivirus gratuitementnorton antivirusantivirus softwareantivirusavastavgbitdefenderfirewalllogiciel antiviruslogiciel antivirusmc afeenorton antivirusnortonspybottelecharger norton antivirustelecharger antivirustelecharger msn 7.5adresse msnastuce msnavatarbotmsn web messengerclin d oeil msne messengeremoticone gratuisemoticone gratuitemoticonejeu de voiturejeu diamantjeu diddljeu educatifjeu en ligne gratuitjeu en lignejeu en reseaujeu gratuit pour enfantjeu enfantjeu erotiquetelecharger divxtelecharger emuleacrobat readeracrobat readeracrobat readerad awareadobe acrobatbase de donneeclone cdclone dvdclone cdcompressionjeu aventurejeu barbiejeu cadeauxcasino jeujeu concours gratuitjeu concoursjeu d argentjeu d echecjeu de billard gratuitjeu de billardjeu cartetelecharger nero 6telecharger nero 7telecharger nerotraducteurtrillianwinampwin mxwinrarwinzipzone alarmemule plusencodeuricqimeshjavatelecharger kazaa litekazaa litetelecharger kazaakazaa litelogiciel architecturelogiciel batimentlogiciel comptabiliteemoticone msnmessenger msnmessengerastuce msnmsn web messengermsn 7.0msn 7.5msn messenger 7.0msn messenger 7.5msn messengermsnblague blondeblague droleblague humourblaguebonne blaguecarte postalevideo comiquediaporama humourpps humourhumour sexyvideo humourhumourimage humourpps humourvideo comiquejeu flashjeu frjeu grattagetelecharger jeu gratuitjeu gratuit enfantjeu gratuitjeu javajeu mobilejeu onlinejeu pc gratuitastrologie gratuiteastrologiehoroscope 2006horoscope balancehoroscope belierhoroscope cancerhoroscope capricornehoroscope chinoishoroscope gemeauhoroscope gratuithoroscope lionhoroscope mensueldvddvd decrypterdvd discountfilm dvddvd musiquedvd pas cherdvd playerdvd pornoecouter and de and la and musiquecomment telecharger un filmfilm a telechargerjeu pcjeu playstation 2jeu pornojeu videojeupc astucerom nintendoromsims 2 telechargementtrucs
Karups Private Collection
Karups Private Collection
Welcome to the king of all grot sites. This site is the mutt's nuts! 1000's of great quality pictures of great quality ladies plus a awesome amount of extra content.. Information on Ariel collection karups and amateur karups pussy
Karup Porn
Karup Girl
Karup Babes
Karup Fetish
Karup Sex
Karup Teen
Karup Collection
Karup Galleries
Karup Freebies
Karup Amateurs
Karup Hometown
Karups Private
Karup PC
Karup
Karupspc
Karups Weekly Freebies
Karups Private Collection (KarupsPC) is a verifiable behemoth. It makes me dizzy after a few pages, because there's just so many super beautiful women to browse through. They have the simplest and featureless members area of any adult site, and it works great somehow. The navigation is key here, as they have just so much content. Things are divided into 5 different (1-5) categories, and then further divided by headings like models, girl/girl, girl/guy, sex, babes, teen, amateur, asian, exotics, mature, more than 3, etc. Each of these has numerous gallery sections, usually ranging from 50 to more than 200 gallery sections! Each of these "volumes" has 9 different photo sets. All this adds up to a massive, high quality collection of over a million pictures.
Karup Babes
Karupspc
Karups Private
Karups PC
Karups Hometown
Karups Freebies
Karups Amateurs
Karups Teen
Karups Sex
Karups Girl
Karups Galleries
Karups Fetish
Karups Galleries
Karups
Karups Porno
anti spyware gratuitavast antivirusantivirus en ligneantivirus gratuitantivirus gratuitementantivirus pour scannerantivirus softwareantivirusavast antivirusavg antivirusavgbitdefendercomparatif antivirusetrustfirewalllogiciel antivirusmcafeemeilleur antivirusnorton antivirus gratuitnorton antivirustelecharger nortonpanda antivirusspybotspywaretelecharger antivirus gratuittelecharger antiviruszone alarm206 tuningaccessoire tuningaccessoire voiture tuningtuning autobmw tuningboitier tuningmoto tuningparis tuning showpiece auto tuningpiece tuningrallyscooter tuningtuning autotuningvoiture tuningblague blondeblague de totoblague droleblague du jourblague humourblague sur les blondeblague telephoneblague videoblaguevideo comiquediaporama humourblague humourhumour et blaguehumour gratuithumour noirhumour sexehumour sexyvideo humourhumourimage comiqueimage humourpps humourblague videovideo comiquevideo humourace mega codecacrobat readerad awarebaladeur mp3clone cdclone dvdcodec audiocodec avicodec divxcodec dvdcodec gratuitpack codeccodec videocodec xvidcodeccompressionconvertir mp3convertisseur mp3codec divxdivx gratuitdivx playerdivxdownload acceleratordriverdvd divxdvd playerdvdedonkey 2000edonkeyemule fremule franceemule gratuitemule paradiseemule plusemuleencodeur mp3enregistreur dvdgraveur dvdhp drivericqimeshjaquette dvdjavakazaa litekazaalecteur mp3logiciel a telechargerlogiciel antiviruslogiciel architecturelogiciel comptabilitelogiciel dessinlogiciel de gravuretelechargement logiciellogiciel de traductionlogiciel gratuitlogicielnero burning romnero expresspack codecripperserveur emuleshareazaskypetelechargement logiciel gratuittelechargement logicieltelechargement p2ptelecharger acrobat readertelecharger ad awaretelecharger antivirustelecharger avasttelecharger divxtelecharger e muletelecharger emule gratuittelecharger emule gratuitementtelecharger emulejeu gratuit a telechargertelecharger javatelecharger kazaa litetelecharger kazaatelecharger nero 6telecharger nero 7telecharger nerotelecharger real playertelecharger shareazatelecharger skypewinamptelecharger winziptelechargertraducteurtrillianwinmxwinrarwinzipzone alarmecran de veille gratuitecran de veillefond d ecran gratuitfond d ecran pcfond ecran sexyfond ecraniconeclone dvdmp3 gratuitlecteur mp3musique mp3prix mp3sonnerie mp3telechargement musique mp3telecharger chansontelecharger codectelecharger mp3 gratuittelecharger mp3tous les driveradresse msnastuce msnavatarclin d oeil msnclin oeilemoticone gratuitemoticone msnemoticonemsn messengermsn 7.5msn messenger 7.5msn messengermsn plusmsn web messengermsn web messengermsnnouvelle version msntelecharger emoticonetelecharger messenger 7.5telecharger messengertelecharger msn 7.5telecharger msn messenger 7.5telecharger msn messenger 8telecharger msn plustelecharger msntelecharger yahoo messengeryahoo messengerchanson arabechanson d amourchanson enfantinechanson francaisechanson paillardeparole chansonchanson pour enfantparole chansonparole chansonparole de chanson francaiseparole et chansonpartition batteriepartition clarinettepartition de chansonpartition musiquepartition flutepartition gratuitepartition guitarepartition pianopartition saxophonepartitionrire et chansontexte de chansontraduction de chansonaperitifbanque postalecarte postale virtuellecarte postalecuisinerecette de cuisinehennemodèle de tatouagepiercing languepiercing nombrilpiercingporcpouletrecetterecette cuisinesoupe aux choutatootatouageastuce jeu videotruc et astuceconsole jeuconsole jeuxfrancaise des jeufrancaise des jeuxtelecharger jeujeu actionjeu adultejeu arcadejeu aventurejeu concoursjeu de billardjeu de cartejeu de damejeu de motojeu de rolejeu de strategiejeu de voiturejeu diamantjeu diddljeu educatifjeu enfantjeu erotiquejeu flashastrologie chinoiseastrologie gratuiteastrologieles chevaliers du zodiaquehoroscope 2006 gratuithoroscope 2006horoscope amoureuxhoroscope balancehoroscope belierhoroscope cancerhoroscope capricornehoroscope chinoishoroscope du jourhoroscope gemeauhoroscope gratuithoroscope lionhoroscope mensuelhoroscope poissonhoroscope sagittairehoroscope scorpionhoroscope taureauhoroscope verseauhoroscope viergehoroscopejeu de tarotsigne du zodiaquetarot marseilletarot divinatoiretarot en lignetarot gratuittarottirage tarot gratuittirage tarot