135254 2006-06-02 04:25 0000 www-client/mozilla-firefox[-bin]: <=1.5.0.3 Multiple vulnerabilities including remote code execution 2006-06-11 13:41:31 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://secunia.com/advisories/20376/ A2 [glsa] Falco P2 major --- 1 falco@gentoo.org security@gentoo.org mozilla@gentoo.org suka@gentoo.org tcort@gentoo.org falco@gentoo.org 2006-06-02 04:25:48 0000 http://secunia.com/advisories/20376/ Description: Multiple vulnerabilities have been reported in Firefox, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and HTTP response smuggling attacks, and potentially compromise a user's system. 1) An error in the sandbox protection of JavaScript run via EvalInSandbox can be exploited to execute arbitrary JavaScript code with escalated privileges by calling the "valueOf()" function on external objects outside of the sandbox. Successful exploitation requires that the attacker is able to execute JavaScript code inside the EvalInSandbox (e.g. via a Proxy Autoconfig script or a third-party extension using the vulnerable functionality). 2) Some errors in the browser engine can be exploited to cause a memory corruption. Successful exploitation may allow execution of arbitrary code. 3) Two errors in the handling of specially crafted HTTP responses in certain situations can be exploited to cause the browser to process a response as two separate responses from different sites. Successful exploitation allows execution of arbitrary HTML and script in a user's browser session in context of an arbitrary site, but requires that the browser is configured to use a proxy or that the malicious site shares the same IP address as the targeted site. 4) Two errors in the handling of the "View Image" and "Show only this frame" functionalities can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site by e.g. tricking a user into right-clicking and choosing "View Image" on a broken image. 5) An error caused due to persisted XUL attributes in certain situations being associated with an incorrect URL can be exploited to execute arbitrary JavaScript code with escalated privileges. 6) An error caused due to content-defined setters on an object prototype being called by privileged code in the user interface can be exploited to execute arbitrary JavaScript code with escalated privileges. 7) An error caused due to an off-by-two array boundary error in the "crypto.signText()" function can be exploited to cause a buffer overflow by passing optional Certificate Authority name arguments. 8) An error exists due to Unicode Byte-order-Mark (BOM) data being stripped from documents served in UTF-8 during the conversion to Unicode. This can be exploited to bypass certain HTML and JavaScript filtering mechanisms in web applications using the UTF-8 character encoding. 9) An error in the processing of the addSelectionListener when handling notifications in certain situations can be exploited to execute arbitrary JavaScript code with escalated privileges. Solution: Update to version 1.5.0.4. http://www.mozilla.com/firefox/ Provided and/or discovered by: 1) moz_bug_r_a4 2) Mozilla Developers 3) Kazuho Oku, Cybozu Labs 4) Paul Nickerson 5) Jonas Sicking, Mozilla 6) Paul Nickerson and moz_bug_r_a4 7) Mikolaj J. Habryn 8) Masatoshi Kimura 9) moz_bug_r_a4 Original Advisory: 1) http://www.mozilla.org/security/announce/2006/mfsa2006-31.html 2) http://www.mozilla.org/security/announce/2006/mfsa2006-32.html 3) http://www.mozilla.org/security/announce/2006/mfsa2006-33.html 4) http://www.mozilla.org/security/announce/2006/mfsa2006-34.html 5) http://www.mozilla.org/security/announce/2006/mfsa2006-35.html 6) http://www.mozilla.org/security/announce/2006/mfsa2006-37.html 7) http://www.mozilla.org/security/announce/2006/mfsa2006-38.html 8) http://www.mozilla.org/security/announce/2006/mfsa2006-42.html 9) http://www.mozilla.org/security/announce/2006/mfsa2006-43.html falco@gentoo.org 2006-06-02 04:26:50 0000 Moz team, please bump 1.5.0.4 ebuild please falco@gentoo.org 2006-06-02 04:47:39 0000 The 1.0 branch is probably vulnerable to certain of the issues, but this is not fixed yet regarding http://www.mozilla.org/projects/security/known-vulnerabilities.html falco@gentoo.org 2006-06-02 04:56:10 0000 adding http://www.mozilla.org/security/announce/2006/mfsa2006-39.html and http://www.mozilla.org/security/announce/2006/mfsa2006-41.html to what Secunia reports the whole list it then : MFSA 2006-43 Privilege escalation using addSelectionListener MFSA 2006-42 Web site XSS using BOM on UTF-8 pages MFSA 2006-41 File stealing by changing input type (variant) MFSA 2006-39 "View Image" local resource linking (Windows) MFSA 2006-38 Buffer overflow in crypto.signText() MFSA 2006-37 Remote compromise via content-defined setter on object prototypes MFSA 2006-36 PLUGINSPAGE privileged JavaScript execution 2 MFSA 2006-35 Privilege escalation through XUL persist MFSA 2006-34 XSS viewing javascript: frames or images from context menu MFSA 2006-33 HTTP response smuggling MFSA 2006-32 Fixes for crashes with potential memory corruption MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey) falco@gentoo.org 2006-06-02 04:58:43 0000 sorry for the spam. I shoud stop bugzie or take some rest carlo@gentoo.org 2006-06-02 06:03:45 0000 According to the advisory all versions are affected. No bugfix for 1.0.8, yet and despite the announcement, I still get "access denied" when I try to look at the relevant upstream bugs. jakub@gentoo.org 2006-06-02 09:05:16 0000 *** Bug 135282 has been marked as a duplicate of this bug. *** suka@gentoo.org 2006-06-02 09:41:23 0000 (In reply to comment #5) > According to the advisory all versions are affected. No bugfix for 1.0.8, yet > and despite the announcement, I still get "access denied" when I try to look at > the relevant upstream bugs. > There won't be any more updates to the 1.0.x-series (and the mozilla-suite), this was publicly announced a few weeks ago: http://developer.mozilla.org/devnews/index.php/2006/04/12/sunset-announcement-for-fxtb-10x-and-mozilla-suite-17x/ geekypenguin@gmail.com 2006-06-02 18:32:58 0000 1.5.0.4 is in the tree feel free to add all archs and have them mark stable. Do not forget to have amd64 and x86 mark -bin stable. geekypenguin@gmail.com 2006-06-02 19:46:58 0000 Well time is here it is 1.5.0.4 for all or nothing. There are gonna be no more revisions for the 1.0.x branch!! If for some reason your arch will not work with 1.5.x we will have to mask firefox on that arch until problem is resolved, patches can be backported but that will be left up to the archs to handle that can not deal with 1.5.x series of firefox. I will handle amd64 source and binary package x86 team do not forget -bin as well please. geekypenguin@gmail.com 2006-06-02 19:52:52 0000 amd64 and ppc already done sorry forgot to add you last go around falco@gentoo.org 2006-06-03 05:36:27 0000 amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be unmaintained by upstream now. falco@gentoo.org 2006-06-03 05:37:14 0000 arches, don't forget -bin :) geekypenguin@gmail.com 2006-06-03 08:16:33 0000 (In reply to comment #11) > amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be > unmaintained by upstream now. > I would suggest ya read the entire bug before adding archs that are already done. gmsoft@gentoo.org 2006-06-03 10:56:08 0000 Stable on hppa. halcy0n@gentoo.org 2006-06-03 19:46:53 0000 x86 done tcort@gentoo.org 2006-06-05 10:18:33 0000 firefox is still broken on alpha, see bug #128777. I've masked 'www-client/mozilla-firefox' in profiles/default-linux/alpha/package.mask until it is fixed. I also masked the 'firefox' USE flag in profiles/default-linux/alpha/use.mask. gustavoz@gentoo.org 2006-06-06 10:03:43 0000 sparc stable. jaervosz@gentoo.org 2006-06-07 11:02:21 0000 Ready for GLSA. jaervosz@gentoo.org 2006-06-11 13:41:31 0000 GLSA 200606-12