|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Gentoo Local Security Checks >> [GLSA-200504-18] Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities Vulnerability Assessment Details
|
[GLSA-200504-18] Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities |
||
Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities Detailed Explanation for this Vulnerability Assessment The remote host is affected by the vulnerability described in GLSA-200504-18 (Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities) The following vulnerabilities were found and fixed in the Mozilla Suite and Mozilla Firefox: Vladimir V. Perepelitsa reported a memory disclosure bug in JavaScript's regular expression string replacement when using an anonymous function as the replacement argument (CVE-2005-0989). moz_bug_r_a4 discovered that Chrome UI code was overly trusting DOM nodes from the content window, permiting privilege escalation via DOM property overrides. Michael Krax reported a possibility to run JavaScript code with elevated rights through the use of javascript: favicons. Michael Krax also discovered that malicious Search tests could run JavaScript in the context of the displayed page or stealthily replace existing search tests. shutdown discovered a technique to pollute the global scope of a window in a way that persists from page to page. Doron Rosenberg discovered a possibility to run JavaScript with elevated rights when the user asks to "Show" a blocked popup that contains a JavaScript URL. Finally, Georgi Guninski reported missing Install object instance checks in the native implementations of XPInstall-related JavaScript objects. The following Firefox-specific vulnerabilities have also been discovered: Kohei Yoshino discovered a new way to abuse the sidebar panel to execute JavaScript with elevated rights. Omar Khan reported that the Plugin Finder Service can be tricked to open javascript: URLs with elevated rights. Impact The various JavaScript execution with elevated rights issues can be exploited by a remote attacker to install malicious code or steal data. The memory disclosure issue can be used to reveal potentially sensitive information. Finally, the cache pollution issue and search test abuse can be leveraged in cross-site-scripting attacks. Workaround There is no known workaround at this time. References: http://www.mozilla.org/projects/security/known-vulnerabilities.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0989 Solution: All Mozilla Firefox users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-1.0.3" All Mozilla Firefox binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-bin-1.0.3" All Mozilla Suite users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.7" All Mozilla Suite binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.7" Network Security Threat Level: Medium Networks Security ID: Vulnerability Assessment Copyright: (C) 2005 Michel Arboi |
||
Cables, Connectors |
NetFu Firewall 1U, Intel CPU, 8 x Gigabit, SFP, w/ pfSense, Others, NEW OPTIONS
$509.58
NEW NetFu Firewall Mini, Intel CPU, 6 x Gigabit, 4gb/64gb, pfSense
$300.00
Cisco ASA5525-FTD-K9 Security Appliance with FirePower Services
$1000.00
Fortinet Fortigate FG-61E | Firewall Network Security Appliance
$49.99
Fortinet FortiGate FG-40F Network Security Firewall
$100.00
OPNsense six-port Gigabit router/firewall on Lanner FW-7535 hardware
$69.00
Fortinet Fortigate 70D Firewall Adapter Network Security Appliance
$52.00
Dell SonicWall TZ300 5-Port Network Security Firewall Appliance APL28-0B4
$24.95
Fortinet Fortiwifi 60D FG-60D Security Appliance Firewall / VPN w/ AC Adapter
$999.97
Fortinet FortiGate 60E & FortiAP 221E+ Network Security Firewall
$260.00
|
||
No Discussions have been posted on this vulnerability. |