Bugzilla Bug 173070

The FTP protocol includes the PASV (passive) command which is used by Firefox
to request an alternate data port. The specification of the FTP protocol allows
the server response to include an alternate server address as well, although
this is rarely used in practice.

mark@bindshell.net reported that a malicious web page hosted on a
specially-coded FTP server could use this feature to perform a rudimentary
port-scan of machines inside the firewall of the victim. By itself this causes
no harm, but information about an internal network may be useful to an attacker
should there be other vulnerabilities present on the network. 


http://www.mozilla.org/security/announce/2007/mfsa2007-11.html


I wonder why no one filed the bug yet and why the mozilla team didn't take
notice in the first place. I hope I didn't missed a bug report, if there was
was one, but I don't think this should be taken lightly.

Mozilla please advise.

Well, the impact is very low. 2.0.0.3 was released mainly due to regressions in
2.0.0.2. Both 2.0.0.3 and 1.5.0.11 are in the tree since they were released.

However, 1.5 series are going to be p.masked. So 2.0.0.3 is the only needed.

Arhces please test and mark stable. Target keywords are:

mozilla-firefox-2.0.0.3.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 mips ppc
ppc64 sparc x86 ~x86-fbsd"
mozilla-firefox-bin-2.0.0.3.ebuild:KEYWORDS="-* amd64 x86"

both emerge and work fine on amd64

Portage 2.1.2.2 (default-linux/amd64/2006.1/desktop, gcc-4.1.1, glibc-2.5-r0,
2.6.20-beyond2 x86_64)
=================================================================
System uname: 2.6.20-beyond2 x86_64 AMD Athlon(tm) 64 X2 Dual Core Processor
4600+
Gentoo Base System release 1.12.9
Timestamp of tree: Mon, 02 Apr 2007 10:50:01 +0000
ccache version 2.4 [enabled]
dev-java/java-config: 1.3.7, 2.0.31
dev-lang/python:     2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.4-r6
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe -msse3 -w"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/java-config/vms/ /etc/php/apache1-php5/ext-active/
/etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/
/etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo"
CXXFLAGS="-march=k8 -O2 -pipe -msse3 -w"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--quiet"
FEATURES="buildsyspkg ccache collision-protect distlocks metadata-transfer
multilib-strict parallel-fetch sandbox sfperms strict test"
GENTOO_MIRRORS="ftp://linux.rz.ruhr-uni-bochum.de/gentoo-mirror/
ftp://ftp.uni-erlangen.de/pub/mirrors/gentoo
ftp://ftp.join.uni-muenster.de/pub/linux/distributions/gentoo
ftp://ftp.wh2.tu-dresden.de/pub/mirrors/gentoo
ftp://ftp.join.uni-muenster.de/pub/linux/distributions/gentoo
ftp://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/
ftp://ftp.gentoo.mesh-solutions.com/gentoo/
ftp://pandemonium.tiscali.de/pub/gentoo/ "
LANG="en_US.ISO8859-15"
LC_ALL="en_US.ISO8859-15"
MAKEOPTS="-j3 -l3 -s --no-print-directory"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_EXTRA_OPTS="--exclude-from=/etc/portage/rsync_excludes"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/overlay"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acpi alsa amd64 amr audiofile berkdb bitmap-fonts bzip2 cairo
cdinstall cdr cli cracklib crypt cups dbus dri dts dvd dvdr dvdread emboss
encode fam firefox fortran gdbm gif gpm gstreamer gtk gtk2 hal iconv jpeg
libg++ logrotate mad midi mikmod mp3 mpeg ncurses nptl nptlonly offensive ogg
opengl pam pcre php png ppds pppd quicktime readline reflection sdl session smp
spl ssl svg symlink tcpd test tiff truetype truetype-fonts type1-fonts unicode
v4l vim vorbis x264 xinerama xorg xv xvid zlib" ALSA_CARDS="emu10k1"
ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file
hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route
share shm softvol" ELIBC="glibc" INPUT_DEVICES="evdev keyboard" KERNEL="linux"
LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses
text" LIRC_DEVICES="inputlirc" USERLAND="GNU" VIDEO_CARDS="nvidia"
Unset:  CTARGET, INSTALL_MASK, LDFLAGS, LINGUAS, PORTAGE_COMPRESS,
PORTAGE_COMPRESS_FLAGS

x86 stable

Stable for HPPA.

ia64 stable

sparc stable.

ppc stable

alpha stable

ppc64 stable

amd64 stable...

This one is ready for GLSA decision. I tend to vote NO.

voting no

this is CVE-2007-1562

voting NO too due to minor impact and closing, feel free to reopen if you
disagree. Sorry for the delay