The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.

Updated Mozilla packages that fix various security bugs are now available.

This update has been rated as having Important security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several bugs were found with the way Mozilla displays the secure site icon. It is possible that a malicious website could display the secure site icon along with incorrect certificate information. (CVE-2005-0143 CVE-2005-0593)

A bug was found in the way Mozilla handles synthetic middle click events. It is possible for a malicious web page to steal the contents of a victims clipboard. (CVE-2005-0146)

Several bugs were found with the way Mozilla handles temporary files.
A local user could view sensitive temporary information or delete arbitrary files. (CVE-2005-0142 CVE-2005-0578)

A bug was found in the way Mozilla handles pop-up windows. It is possible for a malicious website to control the content in an unrelated site's pop-up window. (CVE-2004-1156)

A flaw was found in the way Mozilla displays international domain names. It is possible for an attacker to display a valid URL, tricking the user into thinking they are viewing a legitimate webpage when they are not. (CVE-2005-0233)

A bug was found in the way Mozilla processes XUL content. If a malicious web page can trick a user into dragging an object, it is possible to load malicious XUL content. (CVE-2005-0401)

A bug was found in the way Mozilla handles xsl:include and xsl:import directives. It is possible for a malicious website to import XSLT stylesheets from a domain behind a firewall, leaking information to an attacker. (CVE-2005-0588)

Several bugs were found in the way Mozilla displays alert dialogs. It is possible for a malicious webserver or website to trick a user into thinking the dialog window is being generated from a trusted site.
(CVE-2005-0586 CVE-2005-0591 CVE-2005-0585 CVE-2005-0590 CVE-2005-0584)

A bug was found in the Mozilla JavaScript security manager. If a user drags a malicious link to a tab, the JavaScript security manager is bypassed, which could result in remote code execution or information disclosure. (CVE-2005-0231)

A bug was found in the way Mozilla allows plug-ins to load privileged content into a frame. It is possible that a malicious webpage could trick a user into clicking in certain places to modify configuration settings or execute arbitrary code. (CVE-2005-0232 and CVE-2005-0527)

A bug was found in the way Mozilla handles anonymous functions during regular expression string replacement. It is possible for a malicious web page to capture a random block of browser memory. (CVE-2005-0989)

A bug was found in the way Mozilla displays pop-up windows. If a user choses to open a pop-up window whose URL is malicious JavaScript, the script will be executed with elevated privileges. (CVE-2005-1153)

A bug was found in the way Mozilla installed search plugins. If a user chooses to install a search plugin from a malicious site, the new plugin could silently overwrite an existing plugin. This could allow the malicious plugin to execute arbitrary code and stealm sensitive information. (CVE-2005-1156 CVE-2005-1157)

Several bugs were found in the Mozilla JavaScript engine. A malicious web page could leverage these issues to execute JavaScript with elevated privileges or steal sensitive information. (CVE-2005-1154 CVE-2005-1155 CVE-2005-1159 CVE-2005-1160)

Users of Mozilla are advised to upgrade to this updated package which contains Mozilla version 1.7.7 to correct these issues.

USN-149-1 fixed some vulnerabilities in the Ubuntu 5.04 (Hoary Hedgehog) version of Firefox. The version shipped with Ubuntu 4.10 (Warty Warthog) is also vulnerable to these flaws, so it needs to be upgraded as well. Please see

http://www.ubuntulinux.org/support/documentation/usn/usn-149-1

for the original advisory.

This update also fixes several older vulnerabilities; Some of them could be exploited to execute arbitrary code with full user privileges if the user visited a malicious website. (MFSA-2005-01 to MFSA-2005-44; please see the following website for details:
http://www.mozilla.org/projects/security/known-vulnerabilities.html)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing the patch for the advisory SUSE-SA:2005:016 (Mozilla Firefox).


This security update for Mozilla Firefox fixes following problems:

- CVE-2005-0231: 'Fire tabbing' The javascript security manager usually prevents that a javascript:
URL from one host is opened in a window displaying content from another host. But when the link is dropped to a tab, the security manager does not kick in.

This can lead to several security problems scaling from stealing session cookies to the ability to run arbitrary code on the client system (depending on the displayed site or security settings).

- CVE-2005-0232: 'Fire flashing'

Using plugins like Flash and the -moz-opacity filter it is possible to display the about:config site in a hidden frame or a new window.

By making the user double-click at a specific screen position (e.g. using a DHTML game) you can silently toggle the status of boolean config parameters.

- CVE-2005-0233: 'homograph attacks' / 'IDN cloaking'

Attackers may spoof host names by using translated host name representation which look exactly the same as the original host, allowing phishing attacks or similar.

We now show both IDN punycode and visible form of the host name.

- CVE-2005-0255:

Attackers could cause overflows or crashes in low memory situations.

- Added additional Firefox bugfixes from the 1.0.1 release.


Only the listed distributions are affected, others do not ship Mozilla Firefox.

Also note that Firefox was called Firebird in SUSE Linux 9.0.

The remote host is affected by the vulnerability described in GLSA-200503-30 (Mozilla Suite: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in the Mozilla     Suite:
    Mark Dowd from ISS X-Force reported an exploitable     heap overrun in the GIF processing of obsolete Netscape extension 2     (CAN-2005-0399)     Michael Krax reported that plugins can be used     to load privileged content and trick the user to interact with it     (CAN-2005-0232, CAN-2005-0527)     Michael Krax also reported     potential spoofing or cross-site-scripting issues through overlapping     windows, image or scrollbar drag-and-drop, and by dropping javascript:
    links on tabs (CAN-2005-0230, CAN-2005-0231, CAN-2005-0401,     CAN-2005-0591)     Daniel de Wildt and Gael Delalleau discovered a     memory overwrite in a string library (CAN-2005-0255)     Wind Li     discovered a possible heap overflow in UTF8 to Unicode conversion     (CAN-2005-0592)     Eric Johanson reported that Internationalized     Domain Name (IDN) features allow homograph attacks (CAN-2005-0233)     Mook, Doug Turner, Kohei Yoshino and M. Deaudelin reported various     ways of spoofing the SSL 'secure site' indicator (CAN-2005-0593)     Georgi Guninski discovered that XSLT can include stylesheets from     arbitrary hosts (CAN-2005-0588)     Secunia discovered a way of     injecting content into a popup opened by another website     (CAN-2004-1156)     Phil Ringnalda reported a possible way to     spoof Install source with user:pass@host (CAN-2005-0590)     Jakob     Balle from Secunia discovered a possible way of spoofing the Download     dialog source (CAN-2005-0585)     Christian Schmidt reported a     potential spoofing issue in HTTP auth prompt tab (CAN-2005-0584)     Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team     discovered that Mozilla insecurely creates temporary filenames in     /tmp/plugtmp (CAN-2005-0578)   Impact :

    The GIF heap overflow could be triggered by a malicious GIF     image that would end up executing arbitrary code with the rights of the     user running Mozilla. The other overflow issues, while not thought to     be exploitable, would have the same impact     By setting up     malicious websites and convincing users to follow untrusted links or     obey very specific drag-and-drop or download instructions, attackers     may leverage the various spoofing issues to fake other websites to get     access to confidential information, push users to download malicious     files or make them interact with their browser preferences     The     temporary directory issue allows local attackers to overwrite arbitrary     files with the rights of another local user   Workaround :

    There is no known workaround at this time.

A vulnerability in dcopserver was discovered by Sebastian Krahmer of the SUSE security team. A local user can lock up the dcopserver of other users on the same machine by stalling the DCOP authentication process, causing a local Denial of Service. dcopserver is the KDE Desktop Communication Procotol daemon (CVE-2005-0396).

As well, the IDN (International Domain Names) support in Konqueror is vulnerable to a phishing technique known as a Homograph attack. This attack is made possible due to IDN allowing a website to use a wide range of international characters that have a strong resemblance to other characters. This can be used to trick users into thinking they are on a different trusted site when they are in fact on a site mocked up to look legitimate using these other characters, known as homographs. This can be used to trick users into providing personal information to a site they think is trusted (CVE-2005-0237).

Finally, it was found that the dcopidlng script was vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files of a user when the script is run on behalf of that user. However, this script is only used as part of the build process of KDE itself and may also be used by the build processes of third- party KDE applications (CVE-2005-0365).

The updated packages are patched to deal with these issues and Mandrakesoft encourages all users to upgrade immediately.

The remote host is affected by the vulnerability described in GLSA-200503-10 (Mozilla Firefox: Various vulnerabilities)

    The following vulnerabilities were found and fixed in Mozilla     Firefox:
    Michael Krax reported that plugins can be used     to load privileged content and trick the user to interact with it     (CAN-2005-0232, CAN-2005-0527)     Michael Krax also reported     potential spoofing or cross-site-scripting issues through overlapping     windows, image drag-and-drop, and by dropping javascript: links on tabs     (CAN-2005-0230, CAN-2005-0231, CAN-2005-0591)     Daniel de Wildt     and Gael Delalleau discovered a memory overwrite in a string library     (CAN-2005-0255)     Wind Li discovered a possible heap overflow in     UTF8 to Unicode conversion (CAN-2005-0592)     Eric Johanson     reported that Internationalized Domain Name (IDN) features allow     homograph attacks (CAN-2005-0233)     Mook, Doug Turner, Kohei     Yoshino and M. Deaudelin reported various ways of spoofing the SSL     'secure site' indicator (CAN-2005-0593)     Matt Brubeck reported     a possible Autocomplete data leak (CAN-2005-0589)     Georgi     Guninski discovered that XSLT can include stylesheets from arbitrary     hosts (CAN-2005-0588)     Secunia discovered a way of injecting     content into a popup opened by another website (CAN-2004-1156)     Phil Ringnalda reported a possible way to spoof Install source with     user:pass@host (CAN-2005-0590)     Jakob Balle from Secunia     discovered a possible way of spoofing the Download dialog source     (CAN-2005-0585)     Christian Schmidt reported a potential     spoofing issue in HTTP auth prompt tab (CAN-2005-0584)     Andreas     Sanblad from Secunia discovered a possible way of spoofing the Download     dialog using the Content-Disposition header (CAN-2005-0586)     Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team     discovered that Firefox insecurely creates temporary filenames in     /tmp/plugtmp (CAN-2005-0578)   Impact :

    By setting up malicious websites and convincing users to     follow untrusted links or obey very specific drag-and-drop or download     instructions, attackers may leverage the various spoofing issues to     fake other websites to get access to confidential information, push     users to download malicious files or make them interact with their     browser preferences.
    The temporary directory issue allows     local attackers to overwrite arbitrary files with the rights of another     local user.
    The overflow issues, while not thought to be     exploitable, may allow a malicious downloaded page to execute arbitrary     code with the rights of the user viewing the page.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:176 advisory.

    Mozilla Firefox is an open source Web browser.

    A bug was found in the Firefox string handling functions. If a malicious     website is able to exhaust a system's memory, it becomes possible to     execute arbitrary code. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0255 to this issue.

    A bug was found in the way Firefox handles pop-up windows. It is possible     for a malicious website to control the content in an unrelated site's     pop-up window. (CAN-2004-1156)

    A bug was found in the way Firefox allows plug-ins to load privileged     content into a frame. It is possible that a malicious webpage could trick a     user into clicking in certain places to modify configuration settings or     execute arbitrary code. (CAN-2005-0232 and CAN-2005-0527).

    A flaw was found in the way Firefox displays international domain names. It     is possible for an attacker to display a valid URL, tricking the user into     thinking they are viewing a legitimate webpage when they are not.
    (CAN-2005-0233)

    A bug was found in the way Firefox handles plug-in temporary files. A     malicious local user could create a symlink to a victims directory, causing     it to be deleted when the victim exits Firefox. (CAN-2005-0578)

    A bug has been found in one of Firefox's UTF-8 converters. It may be     possible for an attacker to supply a specially crafted UTF-8 string to the     buggy converter, leading to arbitrary code execution. (CAN-2005-0592)

    A bug was found in the Firefox javascript security manager. If a user drags     a malicious link to a tab, the javascript security manager is bypassed     which could result in remote code execution or information disclosure.
    (CAN-2005-0231)

    A bug was found in the way Firefox displays the HTTP authentication prompt.
    When a user is prompted for authentication, the dialog window is displayed     over the active tab, regardless of the tab that caused the pop-up to appear     and could trick a user into entering their username and password for a     trusted site.  (CAN-2005-0584)

    A bug was found in the way Firefox displays the save file dialog. It is     possible for a malicious webserver to spoof the Content-Disposition header,     tricking the user into thinking they are downloading a different filetype.
    (CAN-2005-0586)

    A bug was found in the way Firefox handles users down-arrow through auto     completed choices. When an autocomplete choice is selected, the information     is copied into the input control, possibly allowing a malicious web site to     steal information by tricking a user into arrowing through autocompletion     choices. (CAN-2005-0589)

    Several bugs were found in the way Firefox displays the secure site icon.
    It is possible that a malicious website could display the secure site icon     along with incorrect certificate information. (CAN-2005-0593)

    A bug was found in the way Firefox displays the download dialog window. A     malicious site can obfuscate the content displayed in the source field,     tricking a user into thinking they are downloading content from a trusted     source. (CAN-2005-0585)

    A bug was found in the way Firefox handles xsl:include and xsl:import     directives. It is possible for a malicious website to import XSLT     stylesheets from a domain behind a firewall, leaking information to an     attacker. (CAN-2005-0588)

    A bug was found in the way Firefox displays the installation confirmation     dialog. An attacker could add a long user:pass before the true hostname,     tricking a user into thinking they were installing content from a trusted     source. (CAN-2005-0590)

    A bug was found in the way Firefox displays download and security dialogs.
    An attacker could cover up part of a dialog window tricking the user into     clicking Allow or Open, which could potentially lead to arbitrary code     execution. (CAN-2005-0591)

    Users of Firefox are advised to upgrade to this updated package which     contains Firefox version 1.0.1 and is not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Firefox is earlier than 1.0.1.  Such versions have multiple security issues, including vulnerabilities that could allow an attacker to impersonate a website by using an International Domain Name, or vulnerabilities that could allow arbitrary code execution.

ID	Name	Product	Family	Severity
21930	CentOS 3 : mozilla (CESA-2005:384)	Nessus	CentOS Local Security Checks	high
20546	Ubuntu 4.10 : mozilla-firefox vulnerabilities (USN-149-3)	Nessus	Ubuntu Local Security Checks	high
20082	SUSE-SA:2005:016: Mozilla Firefox	Nessus	SuSE Local Security Checks	high
18162	RHEL 2.1 / 3 : Mozilla (RHSA-2005:384)	Nessus	Red Hat Local Security Checks	high
17619	GLSA-200503-30 : Mozilla Suite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
17346	Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:058)	Nessus	Mandriva Local Security Checks	high
17276	GLSA-200503-10 : Mozilla Firefox: Various vulnerabilities	Nessus	Gentoo Local Security Checks	high
17252	RHEL 4 : firefox (RHSA-2005:176)	Nessus	Red Hat Local Security Checks	high
17218	Firefox < 1.0.1 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2005-0233

high

Tenable Plugins

high

high

high

high

high

high

high

high

high