Mozilla Firefox 2.0 before 2.0.0.8 allows remote attackers to obtain sensitive system information by using the addMicrosummaryGenerator sidebar method to access file: URIs.

The remote host is affected by the vulnerability described in GLSA-200711-14 (Mozilla Firefox, SeaMonkey, XULRunner: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Mozilla Firefox and     SeaMonkey. Various errors in the browser engine and the JavaScript     engine can be exploited to cause a memory corruption (CVE-2007-5339 and     CVE-2007-5340). Before being used in a request, input passed to the     user ID when making an HTTP request with digest authentication is not     properly sanitised (CVE-2007-2292). The titlebar can be hidden by a XUL     markup language document (CVE-2007-5334). Additionally, an error exists     in the handling of 'smb:' and 'sftp:' URI schemes on systems with     gnome-vfs support (CVE-2007-5337). An unspecified error in the handling     of 'XPCNativeWrappers' and not properly implementing JavaScript     onUnload() handlers may allow the execution of arbitrary JavaScript     code (CVE-2007-5338 and CVE-2007-1095). Another error is triggered by     using the addMicrosummaryGenerator sidebar method to access file: URIs     (CVE-2007-5335).
  Impact :

    A remote attacker could exploit these issues to execute arbitrary code,     gain the privileges of the user running the application, disclose     sensitive information, conduct phishing attacks, and read and     manipulate certain data.
  Workaround :

    There is no known workaround at this time.

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. (CVE-2007-5336, CVE-2007-5339, CVE-2007-5340)

Michal Zalewski discovered that the onUnload event handlers were incorrectly able to access information outside the old page content. A malicious website could exploit this to modify the contents, or steal confidential data (such as passwords), of the next loaded web page.
(CVE-2007-1095)

Stefano Di Paola discovered that Firefox did not correctly request Digest Authentications. A malicious website could exploit this to inject arbitrary HTTP headers or perform session splitting attacks against proxies. (CVE-2007-2292)

Flaws were discovered in the file upload form control. By tricking a user into opening a malicious web page, an attacker could force arbitrary files from the user's computer to be uploaded without their consent. (CVE-2006-2894, CVE-2007-3511)

Eli Friedman discovered that XUL could be used to hide a window's titlebar. A malicious website could exploit this to enhance their attempts at creating phishing websites. (CVE-2007-5334)

Georgi Guninski discovered that Firefox would allow file-system based web pages to access additional files. By tricking a user into opening a malicious web page from a gnome-vfs location, an attacker could steal arbitrary files from the user's computer. (CVE-2007-5337)

It was discovered that the XPCNativeWrappers were not safe in certain situations. By tricking a user into opening a malicious web page, an attacker could run arbitrary JavaScript with the user's privileges.
(CVE-2007-5338).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Oct 19 2007 Christopher Aillon <caillon at     redhat.com> - 2.0.0.8-1

    - Update to 2.0.0.8

    - Tue Oct 16 2007 Martin Stransky <stransky at       redhat.com>

    - added fix for #246248 - firefox crashes when searching

    - Wed Jul 18 2007 Kai Engert <kengert at redhat.com> -       2.0.0.5-1

    - Update to 2.0.0.5

    - Fri Jun 29 2007 Martin Stransky <stransky at       redhat.com> 2.0.0.4-3

    - backported pango patches from FC6 (1.5.0.12)

    - Sun Jun 3 2007 Christopher Aillon <caillon at       redhat.com> 2.0.0.4-2

    - Properly clean up threads with newer NSPR

    - Wed May 30 2007 Christopher Aillon <caillon at       redhat.com> 2.0.0.4-1

    - Final version

    - Wed May 23 2007 Christopher Aillon <caillon at       redhat.com> 2.0.0.4-0.rc3

    - Update to 2.0.0.4 RC3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
28197	GLSA-200711-14 : Mozilla Firefox, SeaMonkey, XULRunner: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
28141	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : firefox vulnerabilities (USN-535-1)	Nessus	Ubuntu Local Security Checks	high
27786	Fedora 7 : firefox-2.0.0.8-1.fc7 (2007-2664)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2007-5335

high

Tenable Plugins

high

high

high