Executive Summary
Summary | |
---|---|
Title | Mozilla Firefox URL protocol handling vulnerability |
Informations | |||
---|---|---|---|
Name | VU#358017 | First vendor Publication | 2007-07-11 |
Vendor | VU-CERT | Last vendor Modification | 2007-07-19 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 4.3 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#358017Mozilla Firefox URL protocol handling vulnerabilityOverviewMozilla Firefox protocol handlers may allow remotely supplied JavaScript to execute with elevated privileges. This may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.I. DescriptionOn Microsoft Windows systems, Mozilla Firefox installs protocol handlers for Mozilla-specific protocols, such as the FirefoxURL and FirefoxHTML protocols. If Microsoft Windows encounters a URL protocol it cannot handle natively it searches the Windows registry for the appropriate protocol handler. When the correct protocol handler is found, Windows passes it the URL string. By design Windows passes the URL string to the protocol handler as it was received without performing any sanitization.Mozilla Firefox URL protocol handlers are constructed in a way that may allow a remote attacker to execute arbitrary JavaScript with elevated (chrome) privileges. Mozilla Firefox security restrictions detect and prevent the execution of such JavaScript. However, if a remote attacker can persuade a user with Firefox installed to access a specially crafted web page using Internet Explorer, and perhaps other Windows applications, the malicious JavaScript will be executed. Reports claim this vulnerability is introduced when Firefox versions 2.0.0.2 and later are installed. Mozilla has addressed this vulnerability in Firefox 2.0.0.5. Disabling the Mozilla Firefox protocol handlers will mitigate this vulnerability. To unregister the protocol handlers, delete or rename the following registry keys:
HKEY_CLASSES_ROOTFirefoxHTML Systems Affected
References
This vulnerability was publicly disclosed by Thor Larholm. This document was written by Jeff Gennari.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/358017 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for Mozilla File : nvt/sles9p5011293.nasl |
2009-05-05 | Name : HP-UX Update for Thunderbird HPSBUX02156 File : nvt/gb_hp_ux_HPSBUX02156.nasl |
2009-04-09 | Name : Mandriva Update for mozilla-firefox MDKSA-2007:152 (mozilla-firefox) File : nvt/gb_mandriva_MDKSA_2007_152.nasl |
2009-03-23 | Name : Ubuntu Update for mozilla-thunderbird vulnerabilities USN-503-1 File : nvt/gb_ubuntu_USN_503_1.nasl |
2009-01-28 | Name : SuSE Update for MozillaFirefox,MozillaThunderbird,Seamonkey SUSE-SA:2007:049 File : nvt/gb_suse_2007_049.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
38017 | Microsoft IE with Mozilla Firefox Cross-browser Command Execution |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2009-02-16 | Name : The remote host contains a web browser that is prone to a cross- browser scri... File : google_chrome_1_0_154_48.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_MozillaFirefox-3932.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-503-1.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaFirefox-3933.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaFirefox-3935.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_MozillaThunderbird-3973.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-3984.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_seamonkey-3986.nasl - Type : ACT_GATHER_INFO |
2007-08-02 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-152.nasl - Type : ACT_GATHER_INFO |