31

Perfidies / Plugindir is the client to Mozilla's plugin vulnerability database. I think a variant of this is used here on this site geared for end users.

I would like to redirect any browser that is using an old version of Java, Silverlight, Flash, etc to a "quarantine" page asking them to upgrade their browser before they are permitted to log in.

  • What technical changes do I need to make to accomplish this?

  • What Perfidies specific javascript objects must I become aware of?

  • Are there any deployment concerns or modifications I should make?

... ...

11
  • I fear that question is probably out of scope for here: you have already decided on the security control you want to implement (decided badly, but that's not relevant to your question :-) and now just need to sort out the tedious implmentation details. One of the Stack Exchanges for web developers will be able to give you much better help.
    – Graham Hill
    Feb 23, 2012 at 10:59
  • @GrahamHill's comment is partially correct. Implementation details, and how to code it, might be better on e.g. SO (assuming enough popularity that there are enough other programmers that have implemented it). However, your third bullet is definitely on topic here - other concerns to take into account.
    – AviD
    Feb 23, 2012 at 11:12
  • 2
    I flagged it to move to Stackoverflow. @GrahamHill If you question my use of this, please comment on this answer. I'd be interested in hearing your thoughts Feb 23, 2012 at 12:33
  • @makerofthings7 moving. Though I think there is still room to ask the last bullet here, as it is a security feature...
    – AviD
    Feb 23, 2012 at 18:23
  • 1
    @makerofthings7 the security risk through JSONP could be reduced by installing the vulenrability DB on your server which would avoid cross-site-JSON-access... another option would be to create a "proxy" on your server which acts as the "secure" middle-man between your clients and the vulnerability DB...
    – Yahia
    Mar 3, 2012 at 17:24

1 Answer 1

1

You should provide some more context to your question. I will try to help you though suggesting a way to do this.

You mentioned you want to disallow users to login, so I think the best way to do this is putting the validation code in the login page as a javascript include. Keep in mind since the script is executed on the client, there is no guarantee that it will really execute and an expert user can circumvent your "protection" by e.g. disabling scripting. But if you are in an intranet and generally trust your users, it shouldn't be a big problem.

To learn how to use Perfidies, I recommend you looking at the following file which you should be able to change to your needs (not tested!). https://github.com/ozten/Perfidies-of-the-Web/blob/master/plugincheck_ui.js

The main function to call seems to be Pfs.findPluginInfos(Pfs.UI.navInfo, browserPlugins, incrementalCallbackFn, finishedCallbackFn). In the incrementalCallbackFn you get all vulnerable plugins. If there exists one, you can redirect the browser to your page.

See the referenced page to see how to fill the other function-parameters.

Regarding deployment I would allow some way to skip this verification, because there are always cases in which you want to allow exceptional access. If your boss needs a report in 5 minutes you don't want to tell him that he has to update his java version first, just because there was an update yesterday which probably isn't even exploited yet.

So maybe show a big red warning for users trying to access the page, but give them a way to ignore the warning if they choose to...

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.