Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 135254 - www-client/mozilla-firefox[-bin]: <=1.5.0.3 Multiple vulnerabilities including remote code execution
Summary: www-client/mozilla-firefox[-bin]: <=1.5.0.3 Multiple vulnerabilities includin...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/20376/
Whiteboard: A2 [glsa] Falco
Keywords:
: 135282 (view as bug list)
Depends on:
Blocks:
 
Reported: 2006-06-02 04:25 UTC by Raphael Marichez (Falco) (RETIRED)
Modified: 2006-06-11 13:41 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-02 04:25:48 UTC
http://secunia.com/advisories/20376/


Description:
Multiple vulnerabilities have been reported in Firefox, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and HTTP response smuggling attacks, and potentially compromise a user's system.

1) An error in the sandbox protection of JavaScript run via EvalInSandbox can be exploited to execute arbitrary JavaScript code with escalated privileges by calling the "valueOf()" function on external objects outside of the sandbox.

Successful exploitation requires that the attacker is able to execute JavaScript code inside the EvalInSandbox (e.g. via a Proxy Autoconfig script or a third-party extension using the vulnerable functionality).

2) Some errors in the browser engine can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

3) Two errors in the handling of specially crafted HTTP responses in certain situations can be exploited to cause the browser to process a response as two separate responses from different sites.

Successful exploitation allows execution of arbitrary HTML and script in a user's browser session in context of an arbitrary site, but requires that the browser is configured to use a proxy or that the malicious site shares the same IP address as the targeted site.

4) Two errors in the handling of the "View Image" and "Show only this frame" functionalities can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an arbitrary site by e.g. tricking a user into right-clicking and choosing "View Image" on a broken image.

5) An error caused due to persisted XUL attributes in certain situations being associated with an incorrect URL can be exploited to execute arbitrary JavaScript code with escalated privileges.

6) An error caused due to content-defined setters on an object prototype being called by privileged code in the user interface can be exploited to execute arbitrary JavaScript code with escalated privileges.

7) An error caused due to an off-by-two array boundary error in the "crypto.signText()" function can be exploited to cause a buffer overflow by passing optional Certificate Authority name arguments.

8) An error exists due to Unicode Byte-order-Mark (BOM) data being stripped from documents served in UTF-8 during the conversion to Unicode. This can be exploited to bypass certain HTML and JavaScript filtering mechanisms in web applications using the UTF-8 character encoding.

9) An error in the processing of the addSelectionListener when handling notifications in certain situations can be exploited to execute arbitrary JavaScript code with escalated privileges.

Solution:
Update to version 1.5.0.4.
http://www.mozilla.com/firefox/

Provided and/or discovered by:
1) moz_bug_r_a4
2) Mozilla Developers
3) Kazuho Oku, Cybozu Labs
4) Paul Nickerson
5) Jonas Sicking, Mozilla
6) Paul Nickerson and moz_bug_r_a4
7) Mikolaj J. Habryn
8) Masatoshi Kimura
9) moz_bug_r_a4

Original Advisory:
1) http://www.mozilla.org/security/announce/2006/mfsa2006-31.html
2) http://www.mozilla.org/security/announce/2006/mfsa2006-32.html
3) http://www.mozilla.org/security/announce/2006/mfsa2006-33.html
4) http://www.mozilla.org/security/announce/2006/mfsa2006-34.html
5) http://www.mozilla.org/security/announce/2006/mfsa2006-35.html
6) http://www.mozilla.org/security/announce/2006/mfsa2006-37.html
7) http://www.mozilla.org/security/announce/2006/mfsa2006-38.html
8) http://www.mozilla.org/security/announce/2006/mfsa2006-42.html
9) http://www.mozilla.org/security/announce/2006/mfsa2006-43.html
Comment 1 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-02 04:26:50 UTC
Moz team, please bump 1.5.0.4 ebuild please
Comment 2 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-02 04:47:39 UTC
The 1.0 branch is probably vulnerable to certain of the issues, but this is not fixed yet regarding http://www.mozilla.org/projects/security/known-vulnerabilities.html
Comment 3 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-02 04:56:10 UTC
adding
http://www.mozilla.org/security/announce/2006/mfsa2006-39.html
and
http://www.mozilla.org/security/announce/2006/mfsa2006-41.html
to what Secunia reports

the whole list it then :

MFSA 2006-43  Privilege escalation using addSelectionListener
MFSA 2006-42 Web site XSS using BOM on UTF-8 pages
MFSA 2006-41 File stealing by changing input type (variant)
MFSA 2006-39 "View Image" local resource linking (Windows)
MFSA 2006-38 Buffer overflow in crypto.signText()
MFSA 2006-37 Remote compromise via content-defined setter on object prototypes
MFSA 2006-36 PLUGINSPAGE privileged JavaScript execution 2
MFSA 2006-35 Privilege escalation through XUL persist
MFSA 2006-34 XSS viewing javascript: frames or images from context menu
MFSA 2006-33 HTTP response smuggling
MFSA 2006-32 Fixes for crashes with potential memory corruption
MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey)
Comment 4 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-02 04:58:43 UTC
sorry for the spam. I shoud stop bugzie or take some rest
Comment 5 Carsten Lohrke (RETIRED) gentoo-dev 2006-06-02 06:03:45 UTC
According to the advisory all versions are affected. No bugfix for 1.0.8, yet and despite the announcement, I still get "access denied" when I try to look at the relevant upstream bugs.
Comment 6 Jakub Moc (RETIRED) gentoo-dev 2006-06-02 09:05:16 UTC
*** Bug 135282 has been marked as a duplicate of this bug. ***
Comment 7 Andreas Proschofsky (RETIRED) gentoo-dev 2006-06-02 09:41:23 UTC
(In reply to comment #5)
> According to the advisory all versions are affected. No bugfix for 1.0.8, yet
> and despite the announcement, I still get "access denied" when I try to look at
> the relevant upstream bugs.
> 

There won't be any more updates to the 1.0.x-series (and the mozilla-suite), this was publicly announced a few weeks ago:

http://developer.mozilla.org/devnews/index.php/2006/04/12/sunset-announcement-for-fxtb-10x-and-mozilla-suite-17x/

Comment 8 Jory A. Pratt 2006-06-02 18:32:58 UTC
1.5.0.4 is in the tree feel free to add all archs and have them mark stable. Do not forget to have amd64 and x86 mark -bin stable.
Comment 9 Jory A. Pratt 2006-06-02 19:46:58 UTC
Well time is here it is 1.5.0.4 for all or nothing. There are gonna be no more revisions for the 1.0.x branch!! If for some reason your arch will not work with 1.5.x we will have to mask firefox on that arch until problem is resolved, patches can be backported but that will be left up to the archs to handle that can not deal with 1.5.x series of firefox. I will handle amd64 source and binary package x86 team do not forget -bin as well please.
Comment 10 Jory A. Pratt 2006-06-02 19:52:52 UTC
amd64 and ppc already done sorry forgot to add you last go around
Comment 11 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-03 05:36:27 UTC
amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be unmaintained by upstream now.
Comment 12 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2006-06-03 05:37:14 UTC
arches, don't forget -bin :)
Comment 13 Jory A. Pratt 2006-06-03 08:16:33 UTC
(In reply to comment #11)
> amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be
> unmaintained by upstream now.
> 
I would suggest ya read the entire bug before adding archs that are already done.
Comment 14 Guy Martin (RETIRED) gentoo-dev 2006-06-03 10:56:08 UTC
Stable on hppa.
Comment 15 Mark Loeser (RETIRED) gentoo-dev 2006-06-03 19:46:53 UTC
x86 done
Comment 16 Thomas Cort (RETIRED) gentoo-dev 2006-06-05 10:18:33 UTC
firefox is still broken on alpha, see bug #128777. I've masked 'www-client/mozilla-firefox' in profiles/default-linux/alpha/package.mask until it is fixed. I also masked the 'firefox' USE flag in  profiles/default-linux/alpha/use.mask.
Comment 17 Gustavo Zacarias (RETIRED) gentoo-dev 2006-06-06 10:03:43 UTC
sparc stable.
Comment 18 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-06-07 11:02:21 UTC
Ready for GLSA.
Comment 19 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-06-11 13:41:31 UTC
GLSA 200606-12