CERT-In Advisory
CIAD-2008-0060
Multiple Vulnerabilities in Mozilla products
Original Issue Date: November 18, 2008
Severity Rating: High
Systems Affected
- Mozilla Firefox 3.0.3 and prior versions
- Mozilla Firefox 2.0.0.17 and prior versions
- Mozilla Thunderbird: 2.0.0.17 and prior versions
- Mozilla SeaMonkey 1.1.12 and prior versions
Overview
Multiple vulnerabilities have been reported in Mozilla Firefox, SeaMonkey and Thunderbird which could allow a remote attacker to bypass certain security restrictions, to disclose sensitive information, or to potentially compromise an affected system.
Description
1. Memory corruption and buffer overflow vulnerability
(
CVE-2008-0017
)
This vulnerability is caused due to an improper check for an allocation failure on a format array when handling a content type of "application/http-index-format in Mozilla firefox and SeaMonkey. A remote attacker could exploit this vulnerability via an HTTP index response with a specially crafted 200 header, which triggers memory corruption and buffer overflow conditions. Successful exploitation of this vulnerability could allow a remote attacker to cause a denial of service condition and execution of an arbitrary code.
2. file: URIs inherit chrome privileges bypass vulnerability
(
CVE-2008-5015
)
A vulnerability has been reported that file:URIs are given chrome privileges when opened in the same tab as a chrome page or privileged about:page. This vulnerability could be exploited by an attacker via malicious code in a file that has already been saved on the local system. A remote attacker can execute arbitrary JavaScript with chrome privileges when a user open a chrome: document or privileged about: URI , and then open the malicious file in the same privileged tab.
3. Layout engine assertion failure vulnerability
(
CVE-2008-5016
)
This vulnerability is caused due to various unspecified flaws in the layout engine in Mozilla firefox, ThunderBird and SeaMonkey. A remote attacker could exploit this vulnerability via multiple vectors which triggers the assertion failure or other consequences to cause denial of service condition.
4. Integer overflow vulnerability in xpcom/io/nsEscape.cpp
(
CVE-2008-5017
)
An Integer overflow in xpcom/io/nsEscape.cpp has been reported in Browser engine in Mozilla firefox, ThunderBird and SeaMonkey. A remote attacker could exploit this vulnerability via unknown vectors which triggers integer overflow to cause denial of service condition.
5. "insufficient class checking" vulnerability in JavaScript engine
(
CVE-2008-5018
)
An "insufficient class checking" vulnerability in the Date class in JavaScript engine has been reported in Mozilla firefox, ThunderBird and SeaMonkey. A remote attacker could exploit this vulnerability via vectors related to "insufficient class checking" to cause denial of service condition.
6. Cross-site scripting XSS vulnerability
(
CVE-2008-5019
)
This vulnerability is caused due to an error in browser's session restore feature in Mozilla Firefox. A remote attacker could exploit this vulnerability to violate the same origin policy via unknown vectors. Successful exploitation of this vulnerability could allow remote attacker to execute an arbitrary JavaScript in the context of another site
7. nsFrameManager crash and remote code execution vulnerability
(
CVE-2008-5021
)
This vulnerability is caused due to an error in DOM constructing code in nsFrameManager in Mozilla Firefox, ThunderBird and SeaMonkey. A remote attacker could exploit this vulnerability by modifying certain properties of a file input element before the element has finished initializing.
8. nsXMLHttpRequest::NotifyEventListeners same-origin policy violation vulnerability
(
CVE-2008-5022
)
This vulnerability is caused due to an error in the implementation of the "nsXMLHttpRequest::NotifyEventListeners " method in Mozilla Firefox, ThunderBird and SeaMonkey. A remote attacker could exploit this vulnerability via multiple listeners to bypass the same origin policy, which bypass the inner window check. Successful exploitation of this vulnerability could allow remote attacker to execute an arbitrary JavaScript code in the context of another site.
9. CSS property codebase principals security bypass vulnerability
(
CVE-2008-5023
)
This vulnerability is caused due to an error when handling the "-moz-binding" CSS property security checks which validate codebase principals. A remote attacker could exploit this vulnerability by replacing a stylesheet in a signed JAR which uses relative paths, and can then use the -moz-binding property to inject malicious script into the JAR.
10. E4X default namespace Parsing error vulnerability
(
CVE-2008-5024
)
This vulnerability is caused due to an error exists when parsing the escape quote characters used in default XML namespace of an E4X document in Mozilla Firefox, ThunderBird and SeaMonkey. A remote attacker could exploit this vulnerability by a specially crafted namespace containing quote characters. Successful exploitation of this vulnerability could allow a remote attacker to inject an arbitrary XML code in default namespace of an E4X document.
Solution
Mozilla Firefox 3.x users update to Mozilla Firefox version 3.0.4.
http://www.mozilla.com/en-US/firefox/all.html
Mozilla Firefox 2.x users update to Mozilla Firefox 2.0.0.18
http://www.mozilla.com/en-US/firefox/all-older.html
Update to Mozilla SeaMonkey version 1.1.13
http://www.seamonkey-project.org/releases/
Vendor Information
Mozilla
http://www.mozilla.org/security/announce/2008/mfsa2008-51.html
http://www.mozilla.org/security/announce/2008/mfsa2008-52.html
http://www.mozilla.org/security/announce/2008/mfsa2008-53.html
http://www.mozilla.org/security/announce/2008/mfsa2008-54.html
http://www.mozilla.org/security/announce/2008/mfsa2008-55.html
http://www.mozilla.org/security/announce/2008/mfsa2008-56.html
References
Bugzilla
https://bugzilla.mozilla.org/show_bug.cgi?id=443299
https://bugzilla.mozilla.org/show_bug.cgi?id=456896
https://bugzilla.mozilla.org/show_bug.cgi?id=460002
https://bugzilla.mozilla.org/show_bug.cgi?id=424733
https://bugzilla.mozilla.org/show_bug.cgi?id=452786
Secunia
http://secunia.com/advisories/32713/
SecurityFocus
http://www.securityfocus.com/bid/32281/info
CVE Name
CVE-2008-0017
CVE-2008-5015
CVE-2008-5016
CVE-2008-5017
CVE-2008-5018
CVE-2008-5019
CVE-2008-5021
CVE-2008-5022
CVE-2008-5023
CVE-2008-5024
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|