9.3 - CVE-2009-1044

Executive Summary

Informations
Name	CVE-2009-1044	First vendor Publication	2009-03-23
Vendor	Cve	Last vendor Modification	2018-10-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1044

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11368

Oval ID:	oval:org.mitre.oval:def:11368
Title:	Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
Description:	Mozilla Firefox 3.0.7 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors related to the _moveToEdgeShift XUL tree method, which triggers garbage collection on objects that are still in use, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-1044	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section seamonkey-nspr is earlier than 0:1.0.9-0.36.el3 AND seamonkey-js-debugger is earlier than 0:1.0.9-0.36.el3 AND seamonkey-nss-devel is earlier than 0:1.0.9-0.36.el3 AND seamonkey is earlier than 0:1.0.9-0.36.el3 AND seamonkey-nspr-devel is earlier than 0:1.0.9-0.36.el3 AND seamonkey-mail is earlier than 0:1.0.9-0.36.el3 AND seamonkey-chat is earlier than 0:1.0.9-0.36.el3 AND seamonkey-devel is earlier than 0:1.0.9-0.36.el3 AND seamonkey-dom-inspector is earlier than 0:1.0.9-0.36.el3 AND seamonkey-nss is earlier than 0:1.0.9-0.36.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section firefox is earlier than 0:3.0.7-3.el4 AND seamonkey-mail is earlier than 0:1.0.9-40.el4 AND seamonkey-js-debugger is earlier than 0:1.0.9-40.el4 AND seamonkey-chat is earlier than 0:1.0.9-40.el4 AND seamonkey-dom-inspector is earlier than 0:1.0.9-40.el4 AND seamonkey-devel is earlier than 0:1.0.9-40.el4 AND seamonkey is earlier than 0:1.0.9-40.el4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section xulrunner-devel-unstable is earlier than 0:1.9.0.7-3.el5 AND xulrunner-devel is earlier than 0:1.9.0.7-3.el5 AND xulrunner is earlier than 0:1.9.0.7-3.el5

Definition Id: oval:org.mitre.oval:def:13356

Oval ID:	oval:org.mitre.oval:def:13356
Title:	DSA-1756-1 xulrunner -- multiple
Description:	Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1169 Security researcher Guido Landi discovered that a XSL stylesheet could be used to crash the browser during a XSL transformation. An attacker could potentially use this crash to run arbitrary code on a victim’s computer. CVE-2009-1044 Security researcher Nils reported via TippingPoint’s Zero Day Initiative that the XUL tree method _moveToEdgeShift was in some cases triggering garbage collection routines on objects which were still in use. In such cases, the browser would crash when attempting to access a previously destroyed object and this crash could be used by an attacker to run arbitrary code on a victim’s computer. Note that after installing these updates, you will need to restart any packages using xulrunner, typically iceweasel or epiphany. For the stable distribution, these problems have been fixed in version 1.9.0.7-0lenny2. As indicated in the Etch release notes, security support for the Mozilla products in the oldstable distribution needed to be stopped before the end of the regular Etch security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a still supported browser. For the unstable distribution, these problems have been fixed in version 1.9.0.8-1 We recommend that you upgrade your xulrunner package.
Family:	unix	Class:	patch
Reference(s):	DSA-1756-1 CVE-2009-1169 CVE-2009-1044	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	xulrunner
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND libmozillainterfaces-java DPKG is earlier than 1.9.0.7-0lenny2 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section libmozjs-dev DPKG is earlier than 1.9.0.7-0lenny2 AND spidermonkey-bin DPKG is earlier than 1.9.0.7-0lenny2 AND xulrunner-1.9-gnome-support DPKG is earlier than 1.9.0.7-0lenny2 AND xulrunner-1.9 DPKG is earlier than 1.9.0.7-0lenny2 AND libmozjs1d-dbg DPKG is earlier than 1.9.0.7-0lenny2 AND libmozjs1d DPKG is earlier than 1.9.0.7-0lenny2 AND python-xpcom DPKG is earlier than 1.9.0.7-0lenny2 AND xulrunner-1.9-dbg DPKG is earlier than 1.9.0.7-0lenny2 AND xulrunner-dev DPKG is earlier than 1.9.0.7-0lenny2

Definition Id: oval:org.mitre.oval:def:7898

Oval ID:	oval:org.mitre.oval:def:7898
Title:	DSA-1756 xulrunner -- multiple vulnerabilities
Description:	Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems: Security researcher Guido Landi discovered that a XSL stylesheet could be used to crash the browser during a XSL transformation. An attacker could potentially use this crash to run arbitrary code on a victim's computer. Security researcher Nils reported via TippingPoint's Zero Day Initiative that the XUL tree method _moveToEdgeShift was in some cases triggering garbage collection routines on objects which were still in use. In such cases, the browser would crash when attempting to access a previously destroyed object and this crash could be used by an attacker to run arbitrary code on a victim's computer. Note that after installing these updates, you will need to restart any packages using xulrunner, typically iceweasel or epiphany. As indicated in the Etch release notes, security support for the Mozilla products in the oldstable distribution needed to be stopped before the end of the regular Etch security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a still supported browser.
Family:	unix	Class:	patch
Reference(s):	DSA-1756 CVE-2009-1169 CVE-2009-1044	Version:	3
Platform(s):	Debian GNU/Linux 5.0	Product(s):	xulrunner
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND libmozillainterfaces-java is earlier than 1.9.0.7-0lenny2 AND libmozjs-dev is earlier than 1.9.0.7-0lenny2 AND spidermonkey-bin is earlier than 1.9.0.7-0lenny2 AND xulrunner-1.9-gnome-support is earlier than 1.9.0.7-0lenny2 AND xulrunner-1.9 is earlier than 1.9.0.7-0lenny2 AND libmozjs1d-dbg is earlier than 1.9.0.7-0lenny2 AND libmozjs1d is earlier than 1.9.0.7-0lenny2 AND python-xpcom is earlier than 1.9.0.7-0lenny2 AND xulrunner-1.9-dbg is earlier than 1.9.0.7-0lenny2 AND xulrunner-dev is earlier than 1.9.0.7-0lenny2

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mozilla Firefox cpe:2.3:a:mozilla:firefox:3.0.7:::::::*	1

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for firefox CESA-2009:0397 centos4 i386 File : nvt/gb_CESA-2009_0397_firefox_centos4_i386.nasl
2011-08-09	Name : CentOS Update for xulrunner CESA-2009:0397 centos5 i386 File : nvt/gb_CESA-2009_0397_xulrunner_centos5_i386.nasl
2011-08-09	Name : CentOS Update for seamonkey CESA-2009:0398-01 centos2 i386 File : nvt/gb_CESA-2009_0398-01_seamonkey_centos2_i386.nasl
2011-08-09	Name : CentOS Update for seamonkey CESA-2009:0398 centos3 i386 File : nvt/gb_CESA-2009_0398_seamonkey_centos3_i386.nasl
2009-10-11	Name : SLES11: Security update for MozillaFirefox File : nvt/sles11_MozillaFirefox0.nasl
2009-04-20	Name : SuSE Security Advisory SUSE-SA:2009:022 (MozillaFirefox) File : nvt/suse_sa_2009_022.nasl
2009-04-15	Name : CentOS Security Advisory CESA-2009:0397 (firefox) File : nvt/ovcesa2009_0397.nasl
2009-04-06	Name : Ubuntu USN-749-1 (libsndfile) File : nvt/ubuntu_749_1.nasl
2009-04-06	Name : RedHat Security Advisory RHSA-2009:0397 File : nvt/RHSA_2009_0397.nasl
2009-04-06	Name : Ubuntu USN-745-1 (xulrunner-1.9) File : nvt/ubuntu_745_1.nasl
2009-04-06	Name : CentOS Security Advisory CESA-2009:0398-01 (seamonkey) File : nvt/ovcesa2009_0398_01.nasl
2009-04-06	Name : CentOS Security Advisory CESA-2009:0398 (seamonkey) File : nvt/ovcesa2009_0398.nasl
2009-04-06	Name : Mandrake Security Advisory MDVSA-2009:084 (firefox) File : nvt/mdksa_2009_084.nasl
2009-04-06	Name : Fedora Core 10 FEDORA-2009-3161 (seamonkey) File : nvt/fcore_2009_3161.nasl
2009-04-06	Name : Fedora Core 9 FEDORA-2009-3101 (seamonkey) File : nvt/fcore_2009_3101.nasl
2009-04-06	Name : Fedora Core 10 FEDORA-2009-3100 (firefox) File : nvt/fcore_2009_3100.nasl
2009-04-06	Name : Fedora Core 9 FEDORA-2009-3099 (firefox) File : nvt/fcore_2009_3099.nasl
2009-04-06	Name : Debian Security Advisory DSA 1756-1 (xulrunner) File : nvt/deb_1756_1.nasl
2009-04-06	Name : RedHat Security Advisory RHSA-2009:0398 File : nvt/RHSA_2009_0398.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
52896	Mozilla Firefox on Windows _moveToEdgeShift() XUL Tree Method Garbage Collect...

Snort® IPS/IDS

Date	Description
2017-08-01	Mozilla Firefox XUL tree element code execution attempt RuleID : 43367 - Revision : 1 - Type : BROWSER-FIREFOX
2014-01-10	Mozilla Firefox XUL tree element code execution attempt RuleID : 17258 - Revision : 9 - Type : BROWSER-FIREFOX

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0397.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0398.nasl - Type : ACT_GATHER_INFO
2013-01-08	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0397.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_MozillaFirefox-090407.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_MozillaFirefox-090407.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_MozillaFirefox-090407.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-745-1.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-3100.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing a security update. File : fedora_2009-3161.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-084.nasl - Type : ACT_GATHER_INFO
2009-04-01	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1756.nasl - Type : ACT_GATHER_INFO
2009-03-31	Name : The remote Fedora host is missing a security update. File : fedora_2009-3101.nasl - Type : ACT_GATHER_INFO
2009-03-30	Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_308.nasl - Type : ACT_GATHER_INFO
2009-03-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0398.nasl - Type : ACT_GATHER_INFO
2009-03-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0397.nasl - Type : ACT_GATHER_INFO
2009-03-30	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-3099.nasl - Type : ACT_GATHER_INFO
2009-03-30	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0398.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/34181
BUGTRAQ	http://www.securityfocus.com/archive/1/502303/100/0/threaded
CONFIRM	http://support.avaya.com/elmodocs2/security/ASA-2009-113.htm http://www.mozilla.org/security/announce/2009/mfsa2009-13.html https://bugzilla.mozilla.org/show_bug.cgi?id=484320
DEBIAN	http://www.debian.org/security/2009/dsa-1756
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01023.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01040.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg01077.html
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:084
MISC	http://blogs.zdnet.com/security/?p=2934 http://blogs.zdnet.com/security/?p=2941 http://cansecwest.com/index.html http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009 http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-in... http://news.cnet.com/8301-1009_3-10199652-83.html http://twitter.com/tippingpoint1/status/1351635812 http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploit... http://www.zerodayinitiative.com/advisories/ZDI-09-015
OSVDB	http://osvdb.org/52896
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-0397.html http://www.redhat.com/support/errata/RHSA-2009-0398.html
SECTRACK	http://www.securitytracker.com/id?1021878
SECUNIA	http://secunia.com/advisories/34471 http://secunia.com/advisories/34505 http://secunia.com/advisories/34510 http://secunia.com/advisories/34511 http://secunia.com/advisories/34521 http://secunia.com/advisories/34527 http://secunia.com/advisories/34549 http://secunia.com/advisories/34550 http://secunia.com/advisories/34792
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00008.html
UBUNTU	http://www.ubuntu.com/usn/usn-745-1
VUPEN	http://www.vupen.com/english/advisories/2009/0864

Alert History

If you want to see full details history, please login or register.

Date	Informations
2020-05-23 00:23:32	Multiple Updates
2018-10-11 00:19:33	Multiple Updates
2017-09-29 09:24:08	Multiple Updates
2016-06-28 17:38:12	Multiple Updates
2016-04-26 18:43:07	Multiple Updates
2014-02-17 10:49:23	Multiple Updates
2014-01-19 21:25:47	Multiple Updates
2013-05-10 23:47:15	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	1
Sources(s)	36
osvdb(s)	1
Openvas Exploit(s)	19
Snort® Rule(s)	2
Nessus® Exploit(s)	18

	Related
10	GLSA-201301-01
9.3	USN-745-1
9.3	RHSA-2009:0398
9.3	RHSA-2009:0397
9.3	MDVSA-2009:084
9.3	DSA-1756
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 6 more Alert(s)

9.3 - CVE-2009-1044

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU