CERT-In Advisory
CIAD-2007-0058
Multiple Vulnerabilities in Mozilla Products
Original Issue Date: October 24, 2007
Severity Rating: High
Systems Affected
- Firefox versions prior to 2.0.0.8
- SeaMonkey versions prior to 1.1.5
Overview
Multiple vulnerabilities have been reported in Mozilla Firefox and Seamonkey which could be exploited by remote attacker to gain elevated privileges, cause denial of service or execute arbitrary code on the affected system.
Description
1. XPCNativeWrappers pollution using Script object
(
CVE-2007-5338
)
A vulnerability has been reported in Mozilla Products due to unspecified error in the handling of "XPCNativeWrappers" .A remote attacker could exploit the vulnerability to execute arbitrary JavaScript with user privileges by using the Script object to modify XPCNativeWrappers in a way that causes the script to be executed when a chrome action is performed.
2.File stealing through sftp protocol
(
CVE-2007-5337
)
A vulnerability has been reported in Firefox due to error in handling of "smb:" and "sftp:" URI schemes on Linux systems with gnome-vfs support. A remote attacker could exploit the vulnerability by hosting a malicious webpage on to a mutually accessible location /tmp on the target server and trick the user into loading the malicious page. In this way the attacker could potentially read any file owned by the victim user from known locations on that server and lead to unauthorized information disclosure.
3.File input focus stealing vulnerability
(
CVE-2007-3511
)
A vulnerability has been reported in Mozilla due to improper handling of form fields. The focus handling for the onkeydown event allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention.
4.Digest authentication HTTP request splitting
(
CVE-2007-2292
)
A vulnerability has been reported in Firefox due to improper validation of user ID when making an HTTP request using Digest Authentication to log into a web site. A malicious page could abuse this to inject arbitrary HTTP headers by including a newline character in the user ID followed by the injected header data. If the request is served via a proxy, the attacker could inject headers that a proxy would interpret as two separate requests for different hosts and conduct HTTP response splitting attacks.
5.Memory Corruption Errors in Browser and JavaScript Engine
(
CVE-2007-5339
)
Multiple vulnerabilities have been reported in Mozilla Products due to memory corruption errors in browser and JavaScript engine while parsing malformed data which could be exploited by remote attacker to crash browser and JavaScript engines and cause denial of service on the affected system.
Successful exploitation of these vulnerabilities may allow execution of arbitrary code.
Solution
Upgrade to Firefox version 2.0.0.8:
http://www.mozilla.com/en-US/firefox/
Upgrade to SeaMonkey version 1.1.5:
http://www.mozilla.org/projects/seamonkey/
Workaround
Vendor Information
Mozilla Foundation
http://www.mozilla.org/security/announce/2007/mfsa2007-35.html
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
http://www.mozilla.org/security/announce/2007/mfsa2007-31.html
References
Frsirt
http://www.frsirt.com/english/advisories/2007/3544
Secunia
http://secunia.com/advisories/27311/
CVE Name
CVE-2007-5338
CVE-2007-5337
CVE-2007-3511
CVE-2007-2292
CVE-2007-5339
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|