0.0.0.0 Day

[linuxrocks123]

I wanted to ask if this recently disclosed vulnerability affects the Linux or MacOS builds of Pale Moon.

https://www.oligo.security/blog/0-0-0-0 ... he-browser

[RealityRipple]

Not recently discovered. It's been a known "non-private" private address bypass for almost 20 years. And I'm not sure I'd call it a bug so much as an exploitable misclassification. It's also a kind of bad *NIX network design leftover that they re-interpret 0.0.0.0 as localhost, effectively bypassing the TCP binding of the server. But yes, the fetch() request will need to be updated to match the spec change.

[Moonchild]

Spec proposal isn't merged yet, but if this is a known issue that should be addressed because of a *NIX networking oddity then I'm all for it.

[RealityRipple]

Not sure, but I think it should just be a matter of checking for '0.0.0.0' in nsDNSService2's PreprocessHostname() function, same as the optionally-blocked .onion URLs.

[Moonchild]

That sounds like a simple solution. I don't really see a reason for legitimate traffic to ever connect to 0.0.0.0 in normal use, anyway. If it's as simple as I think then I can roll this into 33.3.0 -- as it is the first release candidate was in need of changes anyway ;P

[Moonchild]

Pretty painless. See Issue #2554 (UXP). Meaning we'll be ahead of the curve again on something sec related ;P

[ron_1]

Is there anything us users can do to mitigate this while waiting for 33.3.0?

[RealityRipple]

If you don't have any software that runs a local webserver, you're OK.
If you use Windows, you're OK.

Otherwise...

Use HTTPS versions of websites wherever possible.
Don't enable mixed content.
Make any local servers only accessible from the exact local IP on your preferred network(s); don't listen on the localhost or 127.0.0.1 addresses, if the option is there.

[ron_1]

On another forum I found this:

You need to open Filter lists tab in the uBlock dashboard and enable and load Block Outsider Intrusion list under Privacy section.
https://forums.linuxmint.com/viewtopic.php?t=426815

uBo for Pale Moon doesn't have this, and I look around the internet for a way to manually add this, but no luck. Does anyone have any info on this?

[andyprough]

On another forum I found this:

You need to open Filter lists tab in the uBlock dashboard and enable and load Block Outsider Intrusion list under Privacy section.
https://forums.linuxmint.com/viewtopic.php?t=426815

uBo for Pale Moon doesn't have this, and I look around the internet for a way to manually add this, but no luck. Does anyone have any info on this?

We have a long thread on this forum on implementing Block Outsider Intrusion into LAN: viewtopic.php?f=19&t=29982
Seems to work most clearly with the eMatrix extension for Pale Moon: https://addons.palemoon.org/addon/ematrix/

[ron_1]

We have a long thread on this forum on implementing Block Outsider Intrusion into LAN

Thank you. I missed that thread.

[ron_1]

The other thread is locked, so I'll post this here. On my uBo for Block Outsider Intrusion into LAN I'm getting only 7 used out of 7. In the locked thread, others were reporting getting 40 something used out of 62. I'm wondering why my number is so low? (But at least all 7 are used, I guess.)