Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.

This update brings Mozilla Firefox to security update version 2.0.0.5

Following security problems were fixed :

  - Crashes with evidence of memory corruption The usual     collection of stability fixes for crashes that look     suspicious but haven't been proven to be exploitable.
    (MFSA 2007-18)

    25 were in the browser engine, reported by Mozilla     developers and community members Bernd Mielke, Boris     Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,     Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli     Pettay, Paul Nickerson,and Vladimir Sukhoy.
    (CVE-2007-3734)

    7 were in the JavaScript engine reported by Asaf Romano,     Jesse Ruderman, Igor Bukanov. (CVE-2007-3735)

  - XSS using addEventListener and setTimeout. (MFSA 2007-19     / CVE-2007-3736)

    moz_bug_r_a4 reported that scripts could be injected     into another site's context by exploiting a timing issue     using addEventLstener or setTimeout.

  - frame spoofing Ronen Zilberman and Michal Zalewski both     reported that it was possible to exploit a timing issue     to inject content into about:blank frames in a page.
    (MFSA 2007-20 / CVE-2007-3089)

  - Privilege escallation using an event handler attached to     an element not in the document. (MFSA 2007-21 /     CVE-2007-3737)

    Reported by moz_bug_r_a4.

  - File type confusion due to %00 in name. (MFSA 2007-22 /     CVE-2007-3285)

    Ronald van den Heetkamp reported that a filename URL     containing %00 (encoded null) can cause Firefox to     interpret the file extension differently than the     underlying Windows operating system potentially leading     to unsafe actions such as running a program.

  - Remote code execution by launching Firefox from Internet     Explorer. (MFSA 2007-23 / CVE-2007-3670)

    Greg MacManus of iDefense and Billy Rios of Verisign     independently reported that links containing a quote (')     character could be used in Internet Explorer to launch     registered URL Protocol handlers with extra command-line     parameters. Firefox and Thunderbird are among those     which can be launched, and both support a '-chrome'     option that could be used to run malware.

    This problem does not affect Linux.

  - unauthorized access to wyciwyg:// documents. (MFSA     2007-24 / CVE-2007-3656)

    Michal Zalewski reported that it was possible to bypass     the same-origin checks and read from cached (wyciwyg)     documents

  - XPCNativeWrapper pollution shutdown and moz_bug_r_a4     reported two separate ways to modify an XPCNativeWrapper     such that subsequent access by the browser would result     in executing user-supplied code. (MFSA 2007-25 /     CVE-2007-3738)

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. (CVE-2007-3734, CVE-2007-3735)

Flaws were discovered in the JavaScript methods addEventListener and setTimeout which could be used to inject script into another site in violation of the browser's same-origin policy. A malicious website could exploit this to modify the contents, or steal confidential data (such as passwords), of other web pages. (CVE-2007-3736)

Ronen Zilberman and Michal Zalewski discovered timing attacks in the JavaScript engine's use of about:blank frames. A malicious website could exploit this to modify the contents, or steal confidential data (such as passwords), of other web pages. (CVE-2007-3089)

A flaw was discovered in the JavaScript event handling code. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. (CVE-2007-3737)

Ronald van den Heetkamp discovered that filename URLs including an encoded null byte could confuse the extension matching code. By tricking a user into opening a malicious web page, an attacker could execute arbitrary helper programs. (CVE-2007-3285)

Michal Zalewski discovered flaws in the same-origin handling of cached 'wyciwyg://' documents. A malicious website could exploit this to modify the contents, or steal confidential data (such as passwords), of other web pages. (CVE-2007-3656)

Various flaws were discovered in the XPCNativeWrapper method. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. (CVE-2007-3738).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security issues in Mozilla SeaMonkey 1.0.9.

Following security problems were fixed :

  - MFSA 2007-18: Crashes with evidence of memory corruption

    The usual collection of stability fixes for crashes that     look suspicious but haven't been proven to be     exploitable.

    25 were in the browser engine, reported by Mozilla     developers and community members Bernd Mielke, Boris     Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,     Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli     Pettay, Paul Nickerson,and Vladimir Sukhoy     (CVE-2007-3734)

    7 were in the JavaScript engine reported by Asaf Romano,     Jesse Ruderman, Igor Bukanov (CVE-2007-3735)

  - MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener     and setTimeout

    moz_bug_r_a4 reported that scripts could be injected     into another site's context by exploiting a timing issue     using addEventLstener or setTimeout.

  - MFSA 2007-20 / CVE-2007-3089: frame spoofing

    Ronen Zilberman and Michal Zalewski both reported that     it was possible to exploit a timing issue to inject     content into about:blank frames in a page.

  - MFSA 2007-21 / CVE-2007-3737: Privilege escalation using     an event handler attached to an element not in the     document

    Reported by moz_bug_r_a4.

  - MFSA 2007-22 / CVE-2007-3285: File type confusion due to     %00 in name

    Ronald van den Heetkamp reported that a filename URL     containing %00 (encoded null) can cause Firefox to     interpret the file extension differently than the     underlying Windows operating system potentially leading     to unsafe actions such as running a program.

  - MFSA 2007-23 / CVE-2007-3670: Remote code execution by     launching Firefox from Internet Explorer

    Greg MacManus of iDefense and Billy Rios of Verisign     independently reported that links containing a quote (')     character could be used in Internet Explorer to launch     registered URL Protocol handlers with extra command-line     parameters. Firefox and Thunderbird are among those     which can be launched, and both support a '-chrome'     option that could be used to run malware.

    This problem does not affect Linux.

  - MFSA 2007-24 / CVE-2007-3656: unauthorized access to     wyciwyg:// documents

    Michal Zalewski reported that it was possible to bypass     the same-origin checks and read from cached (wyciwyg)     documents

  - MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution

    shutdown and moz_bug_r_a4 reported two separate ways to     modify an XPCNativeWrapper such that subsequent access     by the browser would result in executing user-supplied     code.

This update fixes several security issues in Mozilla SeaMonkey 1.1.3.

Following security problems were fixed :

  - MFSA 2007-18: Crashes with evidence of memory corruption

    The usual collection of stability fixes for crashes that     look suspicious but haven't been proven to be     exploitable.

    25 were in the browser engine, reported by Mozilla     developers and community members Bernd Mielke, Boris     Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,     Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli     Pettay, Paul Nickerson,and Vladimir Sukhoy     (CVE-2007-3734)

    7 were in the JavaScript engine reported by Asaf Romano,     Jesse Ruderman, Igor Bukanov (CVE-2007-3735)

  - MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener     and setTimeout

    moz_bug_r_a4 reported that scripts could be injected     into another site's context by exploiting a timing issue     using addEventLstener or setTimeout.

  - MFSA 2007-20 / CVE-2007-3089: frame spoofing

    Ronen Zilberman and Michal Zalewski both reported that     it was possible to exploit a timing issue to inject     content into about:blank frames in a page.

  - MFSA 2007-21 / CVE-2007-3737: Privilege escalation using     an event handler attached to an element not in the     document

    Reported by moz_bug_r_a4.

  - MFSA 2007-22 / CVE-2007-3285: File type confusion due to     %00 in name

    Ronald van den Heetkamp reported that a filename URL     containing %00 (encoded null) can cause Firefox to     interpret the file extension differently than the     underlying Windows operating system potentially leading     to unsafe actions such as running a program.

  - MFSA 2007-23 / CVE-2007-3670: Remote code execution by     launching Firefox from Internet Explorer

    Greg MacManus of iDefense and Billy Rios of Verisign     independently reported that links containing a quote (')     character could be used in Internet Explorer to launch     registered URL Protocol handlers with extra command-line     parameters. Firefox and Thunderbird are among those     which can be launched, and both support a '-chrome'     option that could be used to run malware.

    This problem does not affect Linux.

  - MFSA 2007-24 / CVE-2007-3656: unauthorized access to     wyciwyg:// documents

    Michal Zalewski reported that it was possible to bypass     the same-origin checks and read from cached (wyciwyg)     documents

  - MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution

    shutdown and moz_bug_r_a4 reported two separate ways to     modify an XPCNativeWrapper such that subsequent access     by the browser would result in executing user-supplied     code.

This update fixes several security problems in Mozilla Thunderbird 1.5.0.12.

Following security problems were fixed :

  - MFSA 2007-18: Crashes with evidence of memory corruption

    The usual collection of stability fixes for crashes that     look suspicious but haven't been proven to be     exploitable.

    25 were in the browser engine, reported by Mozilla     developers and community members Bernd Mielke, Boris     Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,     Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli     Pettay, Paul Nickerson,and Vladimir Sukhoy     (CVE-2007-3734)

    7 were in the JavaScript engine reported by Asaf Romano,     Jesse Ruderman, Igor Bukanov (CVE-2007-3735)

  - MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener     and setTimeout

    moz_bug_r_a4 reported that scripts could be injected     into another site's context by exploiting a timing issue     using addEventLstener or setTimeout.

  - MFSA 2007-20 / CVE-2007-3089: frame spoofing

    Ronen Zilberman and Michal Zalewski both reported that     it was possible to exploit a timing issue to inject     content into about:blank frames in a page.

  - MFSA 2007-21 / CVE-2007-3737: Privilege escalation using     an event handler attached to an element not in the     document

    Reported by moz_bug_r_a4.

  - MFSA 2007-22 / CVE-2007-3285: File type confusion due to     %00 in name

    Ronald van den Heetkamp reported that a filename URL     containing %00 (encoded null) can cause Firefox to     interpret the file extension differently than the     underlying Windows operating system potentially leading     to unsafe actions such as running a program.

  - MFSA 2007-23 / CVE-2007-3670: Remote code execution by     launching Firefox from Internet Explorer

    Greg MacManus of iDefense and Billy Rios of Verisign     independently reported that links containing a quote (')     character could be used in Internet Explorer to launch     registered URL Protocol handlers with extra command-line     parameters. Firefox and Thunderbird are among those     which can be launched, and both support a '-chrome'     option that could be used to run malware.

    This problem does not affect Linux.

  - MFSA 2007-24 / CVE-2007-3656: unauthorized access to     wyciwyg:// documents

    Michal Zalewski reported that it was possible to bypass     the same-origin checks and read from cached (wyciwyg)     documents

  - MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution

    shutdown and moz_bug_r_a4 reported two separate ways to     modify an XPCNativeWrapper such that subsequent access     by the browser would result in executing user-supplied     code.

This update brings Mozilla Firefox to security update version 2.0.0.5

Following security problems were fixed :

  - MFSA 2007-18: Crashes with evidence of memory corruption

    The usual collection of stability fixes for crashes that     look suspicious but haven't been proven to be     exploitable.

    25 were in the browser engine, reported by Mozilla     developers and community members Bernd Mielke, Boris     Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,     Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli     Pettay, Paul Nickerson,and Vladimir Sukhoy     (CVE-2007-3734)

    7 were in the JavaScript engine reported by Asaf Romano,     Jesse Ruderman, Igor Bukanov (CVE-2007-3735)

  - MFSA 2007-19 / CVE-2007-3736: XSS using addEventListener     and setTimeout

    moz_bug_r_a4 reported that scripts could be injected     into another site's context by exploiting a timing issue     using addEventLstener or setTimeout.

  - MFSA 2007-20 / CVE-2007-3089: frame spoofing

    Ronen Zilberman and Michal Zalewski both reported that     it was possible to exploit a timing issue to inject     content into about:blank frames in a page.

  - MFSA 2007-21 / CVE-2007-3737: Privilege escalation using     an event handler attached to an element not in the     document

    Reported by moz_bug_r_a4.

  - MFSA 2007-22 / CVE-2007-3285: File type confusion due to     %00 in name

    Ronald van den Heetkamp reported that a filename URL     containing %00 (encoded null) can cause Firefox to     interpret the file extension differently than the     underlying Windows operating system potentially leading     to unsafe actions such as running a program.

  - MFSA 2007-23 / CVE-2007-3670: Remote code execution by     launching Firefox from Internet Explorer

    Greg MacManus of iDefense and Billy Rios of Verisign     independently reported that links containing a quote (')     character could be used in Internet Explorer to launch     registered URL Protocol handlers with extra command-line     parameters. Firefox and Thunderbird are among those     which can be launched, and both support a '-chrome'     option that could be used to run malware.

    This problem does not affect Linux.

  - MFSA 2007-24 / CVE-2007-3656: unauthorized access to     wyciwyg:// documents

    Michal Zalewski reported that it was possible to bypass     the same-origin checks and read from cached (wyciwyg)     documents

  - MFSA 2007-25 / CVE-2007-3738: XPCNativeWrapper pollution

    shutdown and moz_bug_r_a4 reported two separate ways to     modify an XPCNativeWrapper such that subsequent access     by the browser would result in executing user-supplied     code.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.6.

This update provides the latest Firefox to correct these issues. As well, it provides Firefox 2.0.0.6 for older products.

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3089     Ronen Zilberman and Michal Zalewski discovered that a     timing race allows the injection of content into     about:blank frames.

  - CVE-2007-3656     Michal Zalewski discovered that same-origin policies for     wyciwyg:// documents are insufficiently enforced.

  - CVE-2007-3734     Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz,     Jesse Ruderman, Lukas Loehrer, Martijn Wargers, Mats     Palmgren, Olli Pettay, Paul Nickerson and Vladimir     Sukhoy discovered crashes in the layout engine, which     might allow the execution of arbitrary code.

  - CVE-2007-3735     Asaf Romano, Jesse Ruderman and Igor Bukanov discovered     crashes in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2007-3736     'moz_bug_r_a4' discovered that the addEventListener()     and setTimeout() functions allow cross-site scripting.

  - CVE-2007-3737     'moz_bug_r_a4' discovered that a programming error in     event handling allows privilege escalation.

  - CVE-2007-3738     'shutdown' and 'moz_bug_r_a4' discovered that the     XPCNativeWrapper allows the execution of arbitrary code.

The oldstable distribution (sarge) doesn't include xulrunner.

The installed version of Firefox is affected by various security issues, one of which may lead to execution of arbitrary code on the affected host subject to the user's privileges.

ID	Name	Product	Family	Severity
29361	SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 3932)	Nessus	SuSE Local Security Checks	high
28092	Ubuntu 6.06 LTS / 6.10 / 7.04 : firefox vulnerabilities (USN-490-1)	Nessus	Ubuntu Local Security Checks	high
27444	openSUSE 10 Security Update : seamonkey (seamonkey-3986)	Nessus	SuSE Local Security Checks	high
27443	openSUSE 10 Security Update : seamonkey (seamonkey-3984)	Nessus	SuSE Local Security Checks	high
27132	openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-3973)	Nessus	SuSE Local Security Checks	high
27123	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-3935)	Nessus	SuSE Local Security Checks	high
27122	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-3933)	Nessus	SuSE Local Security Checks	high
25836	Mandrake Linux Security Advisory : mozilla-firefox (MDKSA-2007:152)	Nessus	Mandriva Local Security Checks	high
25780	Debian DSA-1337-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	high
25735	Firefox < 2.0.0.5 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2007-3285

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high