- Description:
The newest GoSuRF Browser v2.54 build version 2.5.504.6101, released on 
1st May 2005, is confirmed as affected to new remote type Multiple 
Browsers Dialog Origin Vulnerability. Tests was done with Secunia test 
page
http://secunia.com/multiple_browsers_dialog_origin_vulnerability_test/ .
 
- Result:
Result was similar when tested with fully patched Microsoft Internet 
Explorer 6.0 (6.0.2800.1106) including cumulative Microsoft June 
security update MS05-025. Issue was tested with Microsoft Windows XP 
Professional US and default browser settings were in use.
 
Opened Script Prompt asking 'password' at this test issue doesn't show 
the origin url of the dialog box. Internal Ads-Blocker's Pop-up Blocker 
doesn't prevent a new dialog box to open. This enables spoofing-type 
attacks.
Menu setting Tools / Ads-Blocker / Block Pop-up Windows is seleced by default.
 
When selecting the test link at Secunia's Test Case / Demonstration 
page, a JavaScript dialog box (in fact, JScript) was displayed in front 
of the Google.com (or localized Google.fi etc.) web site without
information about its origin URL and/or domain name. Typed text was 
appeared to generated 'You entered:' JScript dialog box later.
 
- Technical details:
A dialog box was opened via test-like PHP script, located at 
http://www.google.com.secunia.com/tests/origin_spoof.php . This 
malicious test-type address was not shown to user, however.
 
>From the vendor:
"Forget Internet Explorer! GOSURF brings you a new surf experience. It 
gives each web site its own tab! It works more effectively, but less 
resource required. Stop annoying popup ads and banners in their tracks 
with GOSURF's built in Pop-up blocker."
 
- Solution status:
No solution was available at the time of reporting.
 
- Software:
GoSuRF Browser 2.x
(shareware, 60-day-trial)
 
- Affected versions:
The vulnerability has been reported in v2.54 build version 2.5.504.6101. 
Other versions may also be affected as well.
 
- Vendor:
MMjd.com, Stanly Xu
 
Vendor Home Page:
http://getgosurf.com/
 
Product Home Page:
http://getgosurf.com/?go=features&ln=en
 
Download link for version tested:
http://getgosurf.com/?go=download&ln=en
 
-> links to http://clft.sinhk.com/
 
OS: Microsoft Windows
 
CVE reference: N/A
 
- Solution:
Do not browse untrusted web sites when browsing trusted sites.
 
The following workarounds are provided and tested by the researcher:
- Check the URL address of a browser window opening new dialog box 
titled as 'Explorer User Prompt' and containing text like 'Script 
Prompt' etc. in some way. Dialog box title is localized in non-English
language Windows OSs, e.g. 'Explorerin käyttäjäkehote''. If the domain 
contains multiple domain suffixes, for example
www.real-address.com.non-real-address.com, use the following workaround 
method:
- When typing sensitive information to a Web site password-type dialog 
boxes, be sure that this site is a legitimate site.
 
NOTE: Using multiple domain suffixes may indicate a spoofing attempt. 
Examining of the dialog box addressess can be done by View / Source 
function etc.
 
Additionally, Microsoft has published a security advisory to help IE (or 
software using IE's engine) users to avoid possible spoofing attemps; 
located at
http://www.microsoft.com/technet/security/advisory/902333.mspx .
 
Vendor was contacted on 25th June, 2005 with Support / Feedback / Bug 
report form and an e-mail message. Workarounds were included to the 
report.
 
Timeline:
22-06-2005 - Workaround information sent to local CERT-FI unit
23-06-2005 - CERT-FI replied, no security advisory about Internet 
Explorer or IE based browsers coming
24-06-2005 - Technical details and workarounds provided sent to 
Microsoft Security Response Center
24-06-2005 - MSRC replied
25-06-2005 - Vulnerability in GoSuRF researched
25-06-2005 - Vendor contacted, workarounds offered to the vendor
26-06-2005 - Security companies and several CERT units contacted
 
 
Best regards,
Juha-Matti Laurio, Networksecurity.fi
Security researcher
Finland
http://www.networksecurity.fi