TA08-319AExecutive Summary
| Summary | |
|---|---|
| Title | Mozilla Updates for Multiple Vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | TA08-319A | First vendor Publication | 2008-11-14 |
| Vendor | US-CERT | Last vendor Modification | 2008-11-14 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentification | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
New versions of Firefox, Thunderbird, and SeaMonkey address several vulnerabilities, the most severe of which could allow a remote attacker to execute arbitrary code on an affected system. I. Description The Mozilla and the SeaMonkey projects have released new versions of Firefox, Thunderbird and SeaMonkey to address several vulnerabilities. Further details about these vulnerabilities are available in Mozilla Foundation Security Advisories. An attacker could exploit these vulnerabilities by convincing a user to view a specially crafted HTML document, such as a web page or an HTML email message. II. Impact While the impacts of the individual vulnerabilities vary, the most severe could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. An attacker may also be able to cause a denial of service or execute cross-site scripting attacks. III. Solution Upgrade These vulnerabilities are addressed in Mozilla Firefox 3.0.4, Firefox 2.0.0.18, Thunderbird 2.0.0.18, and SeaMonkey 1.1.13. |
Original Source
| Url : http://www.us-cert.gov/cas/techalerts/TA08-319A.html |
CAPEC : Common Attack Pattern Enumeration & Classification
| id | Name |
|---|---|
| CAPEC-26 | Leveraging Race Conditions |
| CAPEC-29 | Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions |
| CAPEC-172 | Time and State Attacks |
CWE : Common Weakness Enumeration
| id | Name |
|---|---|
| CWE-362 | Race Condition |
| CWE-665 | Improper Initialization |
| CWE-399 | Resource Management Errors |
| CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| CWE-20 | Improper Input Validation |
| CWE-287 | Improper Authentication |
| CWE-264 | Permissions, Privileges, and Access Controls |
| CWE-200 | Information Exposure |
| CWE-189 | Numeric Errors |
| CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10750 | |||
| Oval ID: | oval:org.mitre.oval:def:10750 | ||
| Title: | Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon. | ||
| Description: | Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly change the source URI when processing a canvas element and an HTTP redirect, which allows remote attackers to bypass the same origin policy and access arbitrary images that are not directly accessible to the attacker. NOTE: this issue can be leveraged to enumerate software on the client by performing redirections related to moz-icon. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5012 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
| Definition Id: oval:org.mitre.oval:def:9660 | |||
| Oval ID: | oval:org.mitre.oval:def:9660 | ||
| Title: | Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address. | ||
| Description: | Mozilla Firefox 2.x before 2.0.0.18 and SeaMonkey 1.x before 1.1.13 do not properly check when the Flash module has been dynamically unloaded properly, which allows remote attackers to execute arbitrary code via a crafted SWF file that "dynamically unloads itself from an outside JavaScript function," which triggers an access of an expired memory address. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5013 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
| Definition Id: oval:org.mitre.oval:def:11063 | |||
| Oval ID: | oval:org.mitre.oval:def:11063 | ||
| Title: | Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system. | ||
| Description: | Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrary JavaScript with chrome privileges via malicious code in a file that has already been saved on the local system. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5015 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
| Definition Id: oval:org.mitre.oval:def:9449 | |||
| Oval ID: | oval:org.mitre.oval:def:9449 | ||
| Title: | The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js. | ||
| Description: | The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger memory corruption, as demonstrated by e4x/extensions/regress-410192.js. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-5052 |
Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 |
Product(s): | |
| Definition Synopsis: | |||
|
|||
CPE : Common Platform Enumeration
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 50285 | Mozilla Multiple Product JavaScript Engine AppendAttributeValue Function Remo... |
| 50210 | Mozilla Multiple Products Layout Engine Multiple Function DoS |
| 50182 | Mozilla Multiple Products Codebase Principals Protection Mechanism Bypass Sig... |
| 50181 | Mozilla Multiple Products nsXMLHttpRequest::NotifyEventListeners Method Same-... |
| 50179 | Mozilla Multiple Products nsFrameManager File Input Element Modification Blur... |
| 50178 | Mozilla Multiple Products Session Restore Feature Same-origin Policy Bypass C... |
| 50177 | Mozilla Multiple Products JavaScript Engine Date Class Unspecified Remote DoS |
| 50176 | Mozilla Multiple Products Browser Engine xpcom/io/nsEscape.cpp Unspecified Ov... |
| 50142 | Mozilla Firefox file: URI Chrome Privileges Same Tab Access Local System Save... |
| 50141 | Mozilla Multiple Products jslock.cpp OBJ_IS_NATIVE Function Non-Native Object... |
| 50140 | Mozilla Multiple Products Flash Module SWF File Dynamic Unloading Arbitrary R... |
| 50139 | Mozilla Multiple Products Canvas Element Handling Same-policy Origin Bypass |
| 49995 | Mozilla Multiple Products EX4 Document Handling Remote XML Injection |
| 49925 | Mozilla Multiple Products http-index-format MIME Type Parser Crafted Index Re... |
| 49073 | Mozilla Multiple Products HTML Element .url Shortcut File Arbitrary Cache Dis... |
(Critical)
(High)
(Medium)
