Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 may allow remote attackers to trick users into performing unexpected actions, including installing software, via signed scripts that request enhanced abilities using the enablePrivilege parameter, then modify the meaning of certain security-relevant dialog messages.

Several scripting vulnerabilities were discovered and corrected in Mozilla : CVE-2004-0905 JavaScript; links dragged onto another frame or page allows an attacker to steal or modify sensitive information from other sites. The user could be convinced to drag obscurred links in the context of a game or even a fake scrollbar. If the user could be convinced to drag two links in sequence into a separate window (not frame) the attacker would be able to run arbitrary programs.
CVE-2004-0908 Untrusted JavaScript code can read and write to the clipboard, stealing any sensitive data the user might have copied.
Workaround: disable JavaScript CVE-2004-0909 Signed scripts requesting enhanced abilities could construct the request in a way that led to a confusing grant dialog, possibly fooling the user into thinking the privilege requested was inconsequential while actually obtaining explicit permission to run and install software. Workaround: Never grant enhanced abilities of any kind to untrusted web pages.

A number of vulnerabilities were fixed in mozilla 1.7.3, the following of which have been backported to mozilla packages for Mandrakelinux 10.0 :

  - 'Send page' heap overrun

    - JavaScript clipboard access

    - buffer overflow when displaying VCard

    - BMP integer overflow

    - javascript: link dragging

    - Malicious POP3 server III

The details of all of these vulnerabilities are available from the Mozilla website.

The remote host is affected by the vulnerability described in GLSA-200409-26 (Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities)

    Mozilla-based products are vulnerable to multiple security issues.
    Firstly, routines handling the display of BMP images and VCards contain     an integer overflow and a stack buffer overrun. Specific pages with     long links, when sent using the 'Send Page' function, and links with     non-ASCII hostnames could both cause heap buffer overruns.
    Several issues were found and fixed in JavaScript rights handling:
    untrusted script code could read and write to the clipboard, signed     scripts could build confusing grant privileges dialog boxes, and when     dragged onto trusted frames or windows, JavaScript links could access     information and rights of the target frame or window. Finally,     Mozilla-based mail clients (Mozilla and Mozilla Thunderbird) are     vulnerable to a heap overflow caused by invalid POP3 mail server     responses.
  Impact :

    An attacker might be able to run arbitrary code with the rights of the     user running the software by enticing the user to perform one of the     following actions: view a specially crafted BMP image or VCard, use the     'Send Page' function on a malicious page, follow links with malicious     hostnames, drag multiple JavaScript links in a row to another window,     or connect to an untrusted POP3 mail server. An attacker could also use     a malicious page with JavaScript to disclose clipboard contents or     abuse previously-given privileges to request XPI installation     privileges through a confusing dialog.
  Workaround :

    There is no known workaround covering all vulnerabilities.

ID	Name	Product	Family	Severity
19087	FreeBSD : mozilla -- scripting vulnerabilities (b2e6d1d6-1339-11d9-bc4a-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	medium
15521	Mandrake Linux Security Advisory : mozilla (MDKSA-2004:107)	Nessus	Mandriva Local Security Checks	critical
14781	GLSA-200409-26 : Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2004-0909

medium

Tenable Plugins

medium

critical

critical