Fergie's Tech Blog

Mozilla Suite and Firefox Multiple Code Execution Vulnerabilities

Via FrSIRT.

FrSIRT Advisory : FrSIRT/ADV-2005-1824
CVE Reference : CAN-2005-2871 - CAN-2005-2968 - CAN-2005-2701 - CAN-2005-2702 - CAN-2005-2703 - CAN-2005-2704 - CAN-2005-2705 - CAN-2005-2706 - CAN-2005-2707
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-09-22

* Technical Description *

Nine vulnerabilities were identified in Mozilla Suite and Mozilla Firefox, which may be exploited by remote attackers to execute arbitrary commands or conduct spoofing and cross site scripting attacks.

The first flaw is due to a buffer overflow error when handling malformed URLs containing "soft hyphen" characters, which could be exploited by remote attackers to take complete control of an affected system via specially crafted Web pages. For additional information, see : FrSIRT/ADV-2005-1690

The second vulnerability is due to a heap overflow error when processing specially crafted XBM images, which could be exploited by malicious websites to compromise a vulnerable system.

The third flaw is due to a stack corruption error when processing Unicode sequences with ZWNJ (zero-width non-joiner) characters, which could be exploited by malicious websites to execute arbitrary commands.

The fourth issue occurs when malformed headers are added to an XMLHttpRequest, which could be exploited by attackers to bypass certain security restrictions.

The fifth flaw is due to an error where unprivileged controls from web content can implement XPCOM interfaces, which could be exploited by attackers to execute arbitrary scripts with elevated privileges.

The sixth vulnerability is due to an integer overflow error in the JavaScript engine, which could be exploited by malicious websites to compromise a vulnerable system.

The seventh flaw is due to an error where high privileged "chrome" pages could be loaded from an unprivileged "about:" page, which may be combined with a same-origin violation and exploited to execute arbitrary commands.

The eighth vulnerability is due to an error when opening and handling a specially crafted window, which could be exploited by attackers to bypass certain security features and conduct spoofing attacks.

The ninth issue is due to an input validation error when processing specially crafted URLs containing malicious shell commands enclosed within backquote characters, which could be exploited by remote attackers to compromise a vulnerable system. For additional information, see : FrSIRT/ADV-2005-1794

* Affected Products *

Mozilla Firefox version 1.0.6 and prior
Mozilla Suite version 1.7.11 and prior

* Solution *

Upgrade to Mozilla Firefox 1.0.7 or Mozilla Suite 1.7.12 :
http://www.mozilla.org/products/

* References *

http://www.frsirt.com/english/advisories/2005/1824
http://www.mozilla.org/security/announce/mfsa2005-59.html
http://www.mozilla.org/security/announce/mfsa2005-58.html
http://www.mozilla.org/security/announce/mfsa2005-57.html

posted by Fergie @ 9/22/2005 06:57:00 PM