Firefox before 1.0.2 allows remote attackers to execute arbitrary code by tricking a user into saving a page as a Firefox sidebar panel, then using the sidebar panel to inject Javascript into a privileged page.

USN-149-1 fixed some vulnerabilities in the Ubuntu 5.04 (Hoary Hedgehog) version of Firefox. The version shipped with Ubuntu 4.10 (Warty Warthog) is also vulnerable to these flaws, so it needs to be upgraded as well. Please see

http://www.ubuntulinux.org/support/documentation/usn/usn-149-1

for the original advisory.

This update also fixes several older vulnerabilities; Some of them could be exploited to execute arbitrary code with full user privileges if the user visited a malicious website. (MFSA-2005-01 to MFSA-2005-44; please see the following website for details:
http://www.mozilla.org/projects/security/known-vulnerabilities.html)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Mozilla Foundation Security Advisory states :

If a user bookmarked a malicious page as a Firefox sidebar panel that page could execute arbitrary programs by opening a privileged page and injecting JavaScript into it.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:336 advisory.

    Mozilla Firefox is an open source Web browser.

    A buffer overflow bug was found in the way Firefox processes GIF images. It     is possible for an attacker to create a specially crafted GIF image, which     when viewed by a victim will execute arbitrary code as the victim. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0399 to this issue.

    A bug was found in the way Firefox processes XUL content. If a malicious     web page can trick a user into dragging an object, it is possible to load     malicious XUL content. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0401 to this issue.

    A bug was found in the way Firefox bookmarks content to the sidebar. If a     user can be tricked into bookmarking a malicious web page into the sidebar     panel, that page could execute arbitrary programs. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0402 to this issue.

    Users of Firefox are advised to upgrade to this updated package which     contains Firefox version 1.0.2 and is not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200503-31 (Mozilla Firefox: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in Mozilla     Firefox:
    Mark Dowd from ISS X-Force reported an     exploitable heap overrun in the GIF processing of obsolete Netscape     extension 2 (CAN-2005-0399)     Kohei Yoshino discovered that a     page bookmarked as a sidebar could bypass privileges control     (CAN-2005-0402)     Michael Krax reported a new way to bypass XUL     security restrictions through drag-and-drop of items like scrollbars     (CAN-2005-0401)   Impact :

    The GIF heap overflow could be triggered by a malicious GIF     image that would end up executing arbitrary code with the rights of the     user running Firefox     By tricking the user into bookmarking a     malicious page as a Sidebar, a remote attacker could potentially     execute arbitrary code with the rights of the user running the     browser     By setting up a malicious website and convincing users     to obey very specific drag-and-drop instructions, attackers may     leverage drag-and-drop features to bypass XUL security restrictions,     which could be used as a stepping stone to exploit other     vulnerabilities   Workaround :

    There is no known workaround at this time.

The remote version of Firefox contains various security issues that may allow an attacker to impersonate a website and to trick a user into accepting and executing arbitrary files or to cause a heap overflow in the FireFox process and execute arbitrary code on the remote host.

The remote host is using Firefox. The remote version of this software contains multiple security flaws that can be exploited by a malicious website.  An attacker exploiting one of these flaws would need to be able to either convince a remote user to visit a malicious website or convince the remote user to open an HTML email and save an attachment.
In addition, this version is vulnerable to a remote flaw that could result in arbitrary code execution.  Specifically, if a malicious web page is bookmarked as a sidebar panel, the malicious page may open and inject code into privileged pages.  An attacker exploiting this flaw would need to be able to convince a user to both visit and bookmark their malicious web page.

stripped_description=Versions of Mozilla Firefox prior to 1.7.6 are affected by the following vulnerabilities :

 - There is a flaw in the way that the browser handles scripting within 'tabbed' cross-domains.  An attacker exploiting this flaw would need to be able to convince a user to click on a malicious URL which would then open a separate 'TAB' within the browser.  The attacker could then retrieve data relevant to other tabbed connections or execute code locally.
 - There is a flaw in the default 'about: config' script that would allow an attacker to modify configuration data.  In order to execute such an attack, the attacker would need to be able to entice the user into visiting or clicking on a malicious URL.  A successful attacker would be able to modify the local configuration file, resulting in enhanced access rights or other potential exploits.  In addition, there are other unconfirmed flaws in Mozilla version 1.7.5 and lower. 

The remote host is using Firefox. The remote version of this software contains the following security flaws: 
1) There is a flaw in the way that the browser handle scripting within 'tabbed' cross-domains.  An attacker exploiting this flaw would need to be able to coerce a user into clicking on a malicious URL which would then open a separate 'TAB' within the browser.  The attacker could then retrieve data relevant to other tabbed connections or execute code locally.
2)There is a flaw in the default about: config script that would allow an attacker to modify configuration data. In order to execute such an attack, the attacker would need to be able to entice the user into visiting or clicking on a malicious URL.  A successful attacker would be able to modify the local configuration file, resulting in enhanced access rights or other potential exploits.

The remote host is using Mozilla, a web browser. The remote version of this software contains the following security flaws: 
1) There is a flaw in the way that the browser handles scripting within 'tabbed' cross-domains.  An attacker exploiting this flaw would need to be able to convince a user to click on a malicious URL which would then open a separate 'TAB' within the browser.  The attacker could then retrieve data relevant to other tabbed connections or execute code locally.
2)There is a flaw in the default about: config script that would allow an attacker to modify configuration data.  In order to execute such an attack, the attacker would need to be able to entice the user into visiting or clicking on a malicious URL.  A successful attacker would be able to modify the local configuration file, resulting in enhanced access rights or other potential exploits.  In addition, there are other unconfirmed flaws in Mozilla version 1.7.5 and lower.

ID	Name	Product	Family	Severity
20546	Ubuntu 4.10 : mozilla-firefox vulnerabilities (USN-149-3)	Nessus	Ubuntu Local Security Checks	high
18983	FreeBSD : firefox -- arbitrary code execution from sidebar panel (741f8841-9c6b-11d9-9dbe-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	low
17627	RHEL 4 : firefox (RHSA-2005:336)	Nessus	Red Hat Local Security Checks	high
17620	GLSA-200503-31 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
17603	Firefox < 1.0.2 Multiple Vulnerabilities	Nessus	Windows	medium
2704	Mozilla Firefox < 1.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2671	Mozilla Firefox < 1.7.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
2652	Mozilla Firefox < 1.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
801335	Mozilla Firefox < 1.0.2 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium
801215	Mozilla < 1.7.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800757	Firefox < 1.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2005-0402

critical

Tenable Plugins

high

low

high

medium

medium

medium

high

high

medium

high

medium