Jump to content


Photo

High Security Issues for Mozilla


  • Please log in to reply
19 replies to this topic

#1 Andrax

Andrax

    Andrax.Net Admin

  • Site Admin
  • 9,376 posts

Posted 20 September 2004 - 02:54 PM

Secunia discoveres issues.

Posted Image
Details have been released about several vulnerabilities in Mozilla, Mozilla Firefox, and Thunderbird. These can potentially be exploited by malicious people to conduct cross-site scripting attacks, access and modify sensitive information, and compromise a user's system.

1) Various boundary errors in "nsMsgCompUtils.cpp" can be exploited to cause heap-based buffer overflows when a specially crafted e-mail is forwarded.

Successful exploitation can potentially lead to execution of arbitrary code.

2) Insufficient restrictions on script generated events on text fields can be exploited to read and write content from and to the clipboard.

3) Boundary errors in the "writeGroup()" function in "nsVCardObj.cpp" can be exploited to cause stack-based buffer overflows by sending an e-mail containing a specially crafted vcard.

Successful exploitation may allow execution of arbitrary code but requires that the malicious e-mail is opened in preview.

4) Some boundary errors in "nsPop3Protocol.cpp", which handles POP3 mail communication, can be exploited to cause buffer overflow by a malicious POP3 mail server when sending specially crafted responses.

Successful exploitation may potentially allow execution of arbitrary code.

5) A problem with overly long links containing a non-ASCII characters can be exploited via a malicious website or e-mail to cause a buffer overflow, which potentially can lead to execution of arbitrary code.

6) An integer overflows when parsing and displaying BMP files can potentially be exploited to execute arbitrary code by supplying an overly wide malicious BMP image via a malicious website or in an e-mail.

7) Mozilla allows dragging links to another window or frame. This can e.g be exploited by tricking a user on a malicious website to drag a specially crafted javascript link to another window.

Successful exploitation can cause script code to execute in context of that window. Further exploitation can in combination with another unspecified vulnerability lead to execution of arbitrary code.

8) Signed scripts can request enhanced privileges, which requires that a user accepts a security dialog. The problem is that a malicious website can pass a specially crafted parameter making it possible to manipulate information displayed in the security dialog.

Successful exploitation allows a website to trick users into accepting security dialogs, which will grant access to run arbitrary programs.

9) Some files installed with the Linux installer are group and world writable. This can be exploited by malicious, local users to replace files, which can lead to execution of arbitrary code.

10) Many files and directories in the Linux install ".tar.gz" archives have wrong owner and permissions. This can be exploited by malicious, local users to replace files if the umask is set to be ignored when unpacking.

Successful exploitation can lead to execution of arbitrary code.

These vulnerabilities reportedly affect versions prior to the following:
- Mozilla 1.7.3
- Firefox 1.0PR
- Thunderbird 0.8

Solution:
The vulnerabilities have reportedly been fixed in:
- Mozilla 1.7.3
- Firefox 1.0PR
- Thunderbird 0.8


#2 Lanthar

Lanthar

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 6,464 posts

Posted 21 September 2004 - 08:07 AM

I updated Yesterday ;)
pfsssssssssssssssss... WHAM!
Hold tight! Hold tight? We taped daggers to his hands, he can't help but hold on to them. It seemed like the nice thing to say. After throwing him face first into a rock wall on the other side of a giant sea of fire? Yes.

"si hoc legere scis nimium eruditiones habes"

"You need to take the bull by the balls and run with him" - random inDUHvidual


Posted Image Posted Image

#3 Aenimus

Aenimus

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,674 posts

Posted 21 September 2004 - 08:02 PM

I STILL don't have my extensions back :cry:
Posted ImageHead of the APBC

#4 98YZF600Rdr

98YZF600Rdr

    Power Poster

  • Members
  • PipPipPipPipPip
  • 550 posts

Posted 21 September 2004 - 08:23 PM

Why? What ones are you missing?

#5 Aenimus

Aenimus

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,674 posts

Posted 21 September 2004 - 08:57 PM

All-in-one gestures is the only one i really want back.. bugmenot would be nice too..
Posted ImageHead of the APBC

#6 Webbie

Webbie

    Forum God

  • Moderators
  • 4,064 posts

Posted 22 September 2004 - 05:34 AM

See, the difference is that these are security issues that have been found and fixed. Let'also not forget that Firefox and Thunderbird are still beta. Besides the fact that I think Mozilla's security rewards incentive program works better than what Microsoft does.

Edited by Webbie, 22 September 2004 - 05:37 AM.

"Are you a god?"
"More or less Toblaki. Does that frighten you?"
"I've met gods before. They collect chickens."
"We posess mysterious ways indeed."

#7 Johnny Cool

Johnny Cool

    Johnny Cool

  • Moderators
  • 15,863 posts

Posted 22 September 2004 - 07:36 AM

Opera ... rules. Now at version 7.54. B)

#8 Lanthar

Lanthar

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 6,464 posts

Posted 22 September 2004 - 10:13 AM

All-in-one gestures is the only one i really want back.. bugmenot would be nice too..

the newer FF's will check on extension updates for you...
pfsssssssssssssssss... WHAM!
Hold tight! Hold tight? We taped daggers to his hands, he can't help but hold on to them. It seemed like the nice thing to say. After throwing him face first into a rock wall on the other side of a giant sea of fire? Yes.

"si hoc legere scis nimium eruditiones habes"

"You need to take the bull by the balls and run with him" - random inDUHvidual


Posted Image Posted Image

#9 "Q"

"Q"

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,816 posts

Posted 22 September 2004 - 05:14 PM

Opera ... rules.



Ok. Return to your padded cell now JC. :)
"Lead me to the rock that is higher than I" - Psalm 61

#10 Webbie

Webbie

    Forum God

  • Moderators
  • 4,064 posts

Posted 22 September 2004 - 05:21 PM

Opera is also not free or open source.
"Are you a god?"
"More or less Toblaki. Does that frighten you?"
"I've met gods before. They collect chickens."
"We posess mysterious ways indeed."

#11 "Q"

"Q"

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,816 posts

Posted 22 September 2004 - 05:22 PM

Opera is also not free or open source.


Exactly. Some people have trouble with this part. :rolleyes:
"Lead me to the rock that is higher than I" - Psalm 61

#12 98YZF600Rdr

98YZF600Rdr

    Power Poster

  • Members
  • PipPipPipPipPip
  • 550 posts

Posted 22 September 2004 - 07:11 PM

I don't know how bugmenot and allinone gestures work, but I'm pretty sure I have them installed and I have the newest version of FireFox....


Look at http://texturizer.ne...fox/extensions/ or I think that's where i got them from... they don't say they work, but they seem to.

Edited by 98YZF600Rdr, 22 September 2004 - 07:12 PM.


#13 Aenimus

Aenimus

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,674 posts

Posted 22 September 2004 - 09:07 PM

w00t! got my all-in-one gestures back :D

now for the tabbrowser preferences and bugmenot..
Posted ImageHead of the APBC

#14 Lanthar

Lanthar

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 6,464 posts

Posted 23 September 2004 - 08:00 AM

w00t! got my all-in-one gestures back :D

now for the tabbrowser preferences and bugmenot..

yeah, still waiting on tabbrowser extensions... btw - what does bugmenot do?
pfsssssssssssssssss... WHAM!
Hold tight! Hold tight? We taped daggers to his hands, he can't help but hold on to them. It seemed like the nice thing to say. After throwing him face first into a rock wall on the other side of a giant sea of fire? Yes.

"si hoc legere scis nimium eruditiones habes"

"You need to take the bull by the balls and run with him" - random inDUHvidual


Posted Image Posted Image

#15 Aenimus

Aenimus

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,674 posts

Posted 23 September 2004 - 08:22 AM

that's the one that lets you log in with someone else's account (set up specifically for bugmenot) to sites that require it before you do anything (i.e. fileplanet, and the NY times or whatever silly news sites you people get this inane amount of news from.)
Posted ImageHead of the APBC

#16 Lanthar

Lanthar

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 6,464 posts

Posted 23 September 2004 - 08:23 AM

that's the one that lets you log in with someone else's account (set up specifically for bugmenot) to sites that require it before you do anything (i.e. fileplanet, and the NY times or whatever silly news sites you people get this inane amount of news from.)

that's cool

BTW - This one is quite amusing

and BBCode Rocks

Edited by Lanthar, 23 September 2004 - 08:25 AM.

pfsssssssssssssssss... WHAM!
Hold tight! Hold tight? We taped daggers to his hands, he can't help but hold on to them. It seemed like the nice thing to say. After throwing him face first into a rock wall on the other side of a giant sea of fire? Yes.

"si hoc legere scis nimium eruditiones habes"

"You need to take the bull by the balls and run with him" - random inDUHvidual


Posted Image Posted Image

#17 98YZF600Rdr

98YZF600Rdr

    Power Poster

  • Members
  • PipPipPipPipPip
  • 550 posts

Posted 23 September 2004 - 08:35 AM

Weird....

I use the tabbrowser preferences off of the link I posted.... they work well.

#18 Aenimus

Aenimus

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 4,674 posts

Posted 23 September 2004 - 07:04 PM

does it? maybe i should actually check your link, then :innocent:
Posted ImageHead of the APBC

#19 murf2073

murf2073

    Master Poster

  • Members
  • PipPipPipPipPipPipPip
  • 1,471 posts

Posted 23 September 2004 - 07:59 PM

Tabbrowser extension is the best part of Mozilla. And the absence of popups, and the skins, and the lack of security issues (for the most part). But Tabbrower (and BugMeNot while it lasted) owned.
Posted Image

Murphy's Law- If Anything Can Go Wrong, It Will

#20 Lanthar

Lanthar

    Forum God

  • Members
  • PipPipPipPipPipPipPipPipPipPip
  • 6,464 posts

Posted 23 September 2004 - 07:59 PM

Weird.... 

I use the tabbrowser preferences off of the link I posted.... they work well.

oops... I'm sorry, I'm waiting for bookmark synchronizer
pfsssssssssssssssss... WHAM!
Hold tight! Hold tight? We taped daggers to his hands, he can't help but hold on to them. It seemed like the nice thing to say. After throwing him face first into a rock wall on the other side of a giant sea of fire? Yes.

"si hoc legere scis nimium eruditiones habes"

"You need to take the bull by the balls and run with him" - random inDUHvidual


Posted Image Posted Image