-
-
Firefox 2.0.0.12 Security Update fixes 7 Vulnerability & 3 critical patch (memory corruption, JavaScript Engine Crashes).
Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.11)
- MFSA 2008-11
-
Web forgery overwrite with div overlay
Descriptions
Security researchers Emil Ljungdahl and Lars-Olof Moilanen demonstrated that, in cases where the entire contents of a page are enclosed in a <div> with absolute positioning, a web forgery warning dialog won’t be displayed unless the user switches tabs away-from then back-to the forgery page.
References
- MFSA 2008-10
-
URL token stealing via stylesheet redirect
Descriptions
Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects (much as the document.location property is updated). This differs from other browsers and could potentially reveal sensitive URL parameters, such as those used by Single-signon sytems, to scripts on the page.
References
- MFSA 2008-09
-
Mishandling of locally-saved plain text files
Descriptions
Mozilla contributor oo.rio.oo demonstrated that once a file with Content-Disposition: attachment and (improper) Content-Type: plain/text is saved locally, the browser would no longer open local files with .txt extensions for viewing, but would rather prompt the user to save the file.
References
- MFSA 2008-08
-
File action dialog tampering
Descriptions
Security researcher Michal Zalewski demonstrated that timer-enabled security dialogs can be subverted by attackers using JavaScript to change the window focus. Zalewski showed that a user could be tricked into confirming a security dialog of this type by bringing the dialog back into focus right before a user clicked in a predictable time and place.
References
- MFSA 2008-06
-
Web browsing history and forward navigation stealing
Descriptions
Mozilla contributor David Bloom reported a vulnerability in the way images are treated by the browser when a user leaves a page which utilizes designMode frames. The reported issue can be used to steal a user’s navigation history, forward navigation information, and crash the user’s browser. The crash showed evidence of memory corruption and might be exploitable to run arbitrary code.
References
- MFSA 2008-05
-
Directory traversal via chrome: URI
Descriptions
Gerry Eisenhaur reported the chrome: URI scheme improperly allowed directory traversal that could be used to load JavaScript, images, and stylesheets from local files in known locations. This traversal was possible only when the browser had installed add-ons which used “flat” packaging rather than the more popular .jar packaging, and the attacker would need to target that specific add-on.
Mozilla researcher moz_bug_r_a4 reported that this vulnerability could be used to steal the contents of the browser’s sessionstore.js file, which contains session cookie data and information about currently open web pages.
References
- MFSA 2008-04
-
Stored password corruption
Descriptions
Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or her password, could inject newlines into Firefox’s password store and corrupt saved passwords for other sites.
References
- MFSA 2008-03
-
Privilege escalation, XSS, Remote Code Execution
Descriptions
Mozilla contributors moz_bug_r_a4 and Boris Zbarsky submitted a series of vulnerabilities which allow scripts from page content to escape from its sandboxed context and/or run with chrome privileges. An additional vulnerability reported by moz_bug_r_a4 demonstrated that the XMLDocument.load() function can be used to inject script into another site, violating the browser’s same-origin policy.
References
- MFSA 2008-02
-
Multiple file input focus stealing vulnerabilities
Descriptions
Security researchers hong and Gregory Fleisher each reported a variant on earlier reported bugs regarding focus shifting in file input controls. Their variants used file input controls nested inside <label> tags to take advantage of automatic focus shifting into the file input field noted on the Hacker WebZine. As with the earlier reported issues this issue could be used to force a user to upload arbitrary files assuming the attacker knows the full path and name of the file.
These bugs are variations on earlier problems reported by Charles McAuley and Michal Zalewski which were fixed in Firefox 2.0.0.4, as well as an issue reported by hong which was fixed in Firefox 2.0.0.8.
Gregory Fleisher also submitted a series of demonstrations of different ways to lure a user to place focus into the file input control manually. These demonstrations included “focus spoofing” by selectively capturing keystrokes and placing the captured characters where the user thinks the focus should be.References
- MFSA 2008-01
-
Crashes with evidence of memory corruption (rv:1.8.1.12)
Descriptions
Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox 2.0.0.12 and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.
Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.
References
Thunderbird Security Release
Thunderbird 2.0.0.12 is schedule to be release on February 28.
External Links
-
- February 8, 2008 at 3:45 pm
- February 8, 2008 at 5:09 pm
- 0.3
- url
-
-
"write as if you were talking to a good friend (in front of your mother)."
.haveyoursay
Disclaimer: For any content that you post, you hereby grant to Kakkoi the royalty-free, irrevocable, perpetual, exclusive and fully sublicensable license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform and display such content in whole or in part, world-wide and to incorporate it in other works, in any form, media or technology now known or later developed. Some rights reserved.
One Response to “Firefox 2.0.0.12 Security Release”
[...] View original here: Firefox 2.0.0.12 Security Release [...]