Executive Summary

Informations
NameCVE-2008-4582First vendor Publication2008-10-15
VendorCveLast vendor Modification2012-10-30

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score4.3Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4582

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls

CPE : Common Platform Enumeration

TypeDescriptionCount
Application13
Application29

OpenVAS Exploits

DateDescription
2009-06-03Name : Solaris Update for Mozilla 1.7 125539-06
File : nvt/gb_solaris_125539_06.nasl
2009-06-03Name : Solaris Update for Mozilla Firefox Web browser 125540-06
File : nvt/gb_solaris_125540_06.nasl
2009-03-23Name : Ubuntu Update for firefox, firefox-3.0, xulrunner-1.9 vulnerabilities USN-667-1
File : nvt/gb_ubuntu_USN_667_1.nasl
2009-02-17Name : Fedora Update for Miro FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_Miro_fc8.nasl
2009-02-17Name : Fedora Update for blam FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_blam_fc8.nasl
2009-02-17Name : Fedora Update for cairo-dock FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_cairo-dock_fc8.nasl
2009-02-17Name : Fedora Update for chmsee FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_chmsee_fc8.nasl
2009-02-17Name : Fedora Update for devhelp FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_devhelp_fc8.nasl
2009-02-17Name : Fedora Update for epiphany-extensions FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_epiphany-extensions_fc8.nasl
2009-02-17Name : Fedora Update for epiphany FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_epiphany_fc8.nasl
2009-02-17Name : Fedora Update for evolution-rss FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_evolution-rss_fc8.nasl
2009-02-17Name : Fedora Update for firefox FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_firefox_fc8.nasl
2009-02-17Name : Fedora Update for galeon FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_galeon_fc8.nasl
2009-02-17Name : Fedora Update for gnome-python2-extras FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_gnome-python2-extras_fc8.nasl
2009-02-17Name : Fedora Update for gnome-web-photo FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_gnome-web-photo_fc8.nasl
2009-02-17Name : Fedora Update for kazehakase FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_kazehakase_fc8.nasl
2009-02-17Name : Fedora Update for liferea FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_liferea_fc8.nasl
2009-02-17Name : Fedora Update for openvrml FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_openvrml_fc8.nasl
2009-02-17Name : Fedora Update for ruby-gnome2 FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_ruby-gnome2_fc8.nasl
2009-02-17Name : Fedora Update for seamonkey FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_seamonkey_fc8.nasl
2009-02-17Name : Fedora Update for yelp FEDORA-2008-9667
File : nvt/gb_fedora_2008_9667_yelp_fc8.nasl
2009-02-17Name : Fedora Update for Miro FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_Miro_fc9.nasl
2009-02-17Name : Fedora Update for cairo-dock FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_cairo-dock_fc9.nasl
2009-02-17Name : Fedora Update for chmsee FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_chmsee_fc9.nasl
2009-02-17Name : Fedora Update for devhelp FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_devhelp_fc9.nasl
2009-02-17Name : Fedora Update for epiphany-extensions FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_epiphany-extensions_fc9.nasl
2009-02-17Name : Fedora Update for epiphany FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_epiphany_fc9.nasl
2009-02-17Name : Fedora Update for evolution-rss FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_evolution-rss_fc9.nasl
2009-02-17Name : Fedora Update for firefox FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_firefox_fc9.nasl
2009-02-17Name : Fedora Update for galeon FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_galeon_fc9.nasl
2009-02-17Name : Fedora Update for gnome-python2-extras FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_gnome-python2-extras_fc9.nasl
2009-02-17Name : Fedora Update for gnome-web-photo FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_gnome-web-photo_fc9.nasl
2009-02-17Name : Fedora Update for google-gadgets FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_google-gadgets_fc9.nasl
2009-02-17Name : Fedora Update for gtkmozembedmm FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_gtkmozembedmm_fc9.nasl
2009-02-17Name : Fedora Update for kazehakase FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_kazehakase_fc9.nasl
2009-02-17Name : Fedora Update for mozvoikko FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_mozvoikko_fc9.nasl
2009-02-17Name : Fedora Update for mugshot FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_mugshot_fc9.nasl
2009-02-17Name : Fedora Update for ruby-gnome2 FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_ruby-gnome2_fc9.nasl
2009-02-17Name : Fedora Update for seamonkey FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_seamonkey_fc9.nasl
2009-02-17Name : Fedora Update for totem FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_totem_fc9.nasl
2009-02-17Name : Fedora Update for xulrunner FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_xulrunner_fc9.nasl
2009-02-17Name : Fedora Update for yelp FEDORA-2008-9669
File : nvt/gb_fedora_2008_9669_yelp_fc9.nasl
2009-01-13Name : Debian Security Advisory DSA 1696-1 (icedove)
File : nvt/deb_1696_1.nasl
2009-01-13Name : Debian Security Advisory DSA 1697-1 (iceape)
File : nvt/deb_1697_1.nasl
2008-12-03Name : Debian Security Advisory DSA 1671-1 (iceweasel)
File : nvt/deb_1671_1.nasl
2008-11-24Name : Debian Security Advisory DSA 1669-1 (xulrunner)
File : nvt/deb_1669_1.nasl
2008-11-19Name : FreeBSD Ports: firefox
File : nvt/freebsd_firefox35.nasl
2008-10-17Name : Firefox .url Shortcut File Information Disclosure Vulnerability
File : nvt/gb_firefox_url_file_info_dis_vuln.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
49073Mozilla Multiple Products HTML Element .url Shortcut File Arbitrary Cache Dis...

Nessus® Vulnerability Scanner

DateDescription
2013-01-08Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2009-04-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-667-1.nasl - Type : ACT_GATHER_INFO
2009-01-08Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1696.nasl - Type : ACT_GATHER_INFO
2009-01-08Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1697.nasl - Type : ACT_GATHER_INFO
2008-11-25Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1671.nasl - Type : ACT_GATHER_INFO
2008-11-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1669.nasl - Type : ACT_GATHER_INFO
2008-11-16Name : The remote Fedora host is missing one or more security updates.
File : fedora_2008-9667.nasl - Type : ACT_GATHER_INFO
2008-11-16Name : The remote Fedora host is missing one or more security updates.
File : fedora_2008-9669.nasl - Type : ACT_GATHER_INFO
2008-11-14Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_f29fea8fb19f11dda55e00163e000016.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_304.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : A web browser on the remote host is affected by multiple vulnerabilities.
File : seamonkey_1113.nasl - Type : ACT_GATHER_INFO
2008-11-13Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_20018.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/31611
http://www.securityfocus.com/bid/31747
BUGTRAQhttp://www.securityfocus.com/archive/1/archive/1/497091/100/0/threaded
CERThttp://www.us-cert.gov/cas/techalerts/TA08-319A.html
CONFIRMhttp://www.mozilla.org/security/announce/2008/mfsa2008-47.html
DEBIANhttp://www.debian.org/security/2008/dsa-1669
http://www.debian.org/security/2008/dsa-1671
http://www.debian.org/security/2009/dsa-1696
http://www.debian.org/security/2009/dsa-1697
FEDORAhttps://www.redhat.com/archives/fedora-package-announce/2008-November/msg0036...
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg0038...
MISChttp://liudieyu0.blog124.fc2.com/blog-entry-6.html
https://bugzilla.mozilla.org/show_bug.cgi?id=455311
SECTRACKhttp://securitytracker.com/alerts/2008/Nov/1021190.html
http://securitytracker.com/alerts/2008/Nov/1021212.html
http://www.securitytracker.com/id?1021190
SECUNIAhttp://secunia.com/advisories/32192
http://secunia.com/advisories/32684
http://secunia.com/advisories/32693
http://secunia.com/advisories/32714
http://secunia.com/advisories/32721
http://secunia.com/advisories/32778
http://secunia.com/advisories/32845
http://secunia.com/advisories/32853
http://secunia.com/advisories/33433
http://secunia.com/advisories/33434
http://secunia.com/advisories/34501
SREASONhttp://securityreason.com/securityalert/4416
SUNALERThttp://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
UBUNTUhttp://ubuntu.com/usn/usn-667-1
VUPENhttp://www.vupen.com/english/advisories/2008/2818
http://www.vupen.com/english/advisories/2009/0977
XFhttp://xforce.iss.net/xforce/xfdb/45740

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:46:57
  • Multiple Updates
2013-05-11 00:28:25
  • Multiple Updates