Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes it easier for remote attackers to spoof URLs and conduct phishing attacks.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0315 advisory.

    firefox:

    [3.0.7-1.0.1]
    - Update firstrun and homepage URLs
    - Added firefox-oracle-default-prefs.js/firefox-oracle-default-bookmarks.html       and removed the corresponding  Red Hat ones
    - Added patch oracle-firefox-branding.patch

    [3.0.7-1]
    - Update to Firefox 3.0.7

    [3.0.6-2]
    - Fixed #481805 (Unowned directory /usr/lib/firefox-*/modules)

    xulrunner:

    [1.9.0.7-1.0.1]
    - Added xulrunner-oracle-default-prefs.js and removed       xulrunner-redhat-default-prefs.js

    [1.9.0.7-1]
    - Update to 1.9.0.7

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774,CVE-2009-0775)

Several flaws were found in the way malformed content was processed. A website containing specially crafted content could, potentially, trick a Firefox user into surrendering sensitive information.
(CVE-2009-0776, CVE-2009-0777)

After installing the update, Firefox must be restarted for the changes to take effect.

The Mozilla Firefox browser is updated to version 3.0.7 fixing various security and stability issues.

  - Mozilla developers identified and fixed several     stability bugs in the browser engine used in Firefox and     other Mozilla-based products. Some of these crashes     showed evidence of memory corruption under certain     circumstances and we presume that with enough effort at     least some of these could be exploited to run arbitrary     code. (MFSA 2009-07 / CVE-2009-0771 / CVE-2009-0772 /     CVE-2009-0773 / CVE-2009-0774)

  - An anonymous researcher, via TippingPoint's Zero Day     Initiative program, reported a vulnerability in     Mozilla's garbage collection process. The vulnerability     was caused by improper memory management of a set of     cloned XUL DOM elements which were linked as a parent     and child. After reloading the browser on a page with     such linked elements, the browser would crash when     attempting to access an object which was already     destroyed. An attacker could use this crash to run     arbitrary code on the victim's computer. (MFSA 2009-08 /     CVE-2009-0775)

  - Mozilla security researcher Georgi Guninski reported     that a website could use nsIRDFService and a     cross-domain redirect to steal arbitrary XML data from     another domain, a violation of the same-origin policy.
    This vulnerability could be used by a malicious website     to steal private data from users authenticated to the     redirected website. (MFSA 2009-09 / CVE-2009-0776)

  - libpng maintainer Glenn Randers-Pehrson reported several     memory safety hazards in PNG libraries used by Mozilla.
    These vulnerabilities could be used by a malicious     website to crash a victim's browser and potentially     execute arbitrary code on their computer. libpng was     upgraded to a version which contained fixes for these     flaws. (MFSA 2009-10 / CVE-2009-0040)

  - Mozilla contributor Masahiro Yamada reported that     certain invisible control characters were being decoded     when displayed in the location bar, resulting in fewer     visible characters than were present in the actual     location. An attacker could use this vulnerability to     spoof the location bar and display a misleading URL for     their malicious web page. (MFSA 2009-11 / CVE-2009-0777)

The Mozilla Firefox browser is updated to version 3.0.7 fixing various security and stability issues.

MFSA 2009-07 / CVE-2009-0771 / CVE-2009-0772 / CVE-2009-0773 / CVE-2009-0774: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2009-08 / CVE-2009-0775: An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's garbage collection process. The vulnerability was caused by improper memory management of a set of cloned XUL DOM elements which were linked as a parent and child. After reloading the browser on a page with such linked elements, the browser would crash when attempting to access an object which was already destroyed. An attacker could use this crash to run arbitrary code on the victim's computer.

MFSA 2009-09 / CVE-2009-0776: Mozilla security researcher Georgi Guninski reported that a website could use nsIRDFService and a cross-domain redirect to steal arbitrary XML data from another domain, a violation of the same-origin policy. This vulnerability could be used by a malicious website to steal private data from users authenticated to the redirected website.

MFSA 2009-10 / CVE-2009-0040: libpng maintainer Glenn Randers-Pehrson reported several memory safety hazards in PNG libraries used by Mozilla. These vulnerabilities could be used by a malicious website to crash a victim's browser and potentially execute arbitrary code on their computer. libpng was upgraded to a version which contained fixes for these flaws.

MFSA 2009-11 / CVE-2009-0777: Mozilla contributor Masahiro Yamada reported that certain invisible control characters were being decoded when displayed in the location bar, resulting in fewer visible characters than were present in the actual location. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page.

Glenn Randers-Pehrson discovered that the embedded libpng in Firefox did not properly initialize pointers. If a user were tricked into viewing a malicious website with a crafted PNG file, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0040)

Martijn Wargers, Jesse Ruderman, Josh Soref, Gary Kwong, and Timothee Groleau discovered flaws in the browser engine. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774)

A flaw was discovered in Firefox's garbage collection process. Under certain circumstances a remote attacker could exploit this to cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0775)

Georgi Guninski discovered a flaw when Firefox performed a cross-domain redirect. An attacker could bypass the same-origin policy in Firefox by utilizing nsIRDFService and steal private data from users authenticated to the redirected website. (CVE-2009-0776)

Masahiro Yamada discovered that Firefox did not display control characters in the location bar. An attacker could exploit this to spoof the location bar, such as in a phishing attack. (CVE-2009-0777).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox 3.x, version 3.0.7 (CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775, CVE-2009-0776, CVE-2009-0777).

This update provides the latest Mozilla Firefox 3.x to correct these issues.

As Mozilla Firefox 2.x has been phased out, version 3.x is also being provided for Mandriva Linux 2008 Spring.

Additionally some softwares has also been rebuilt against Mozilla Firefox 3.0.7 which should take care of upgrade problems.

Update to the new upstream Firefox 3.0.7 / XULRunner 1.9.0.7 fixing multiple security issues: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.7 This update also contains new builds of all applications depending on Gecko libraries, built against the new version. Note: after the updated packages are installed, Firefox must be restarted for the update to take effect.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of SeaMonkey is earlier than 1.1.15.  Such versions are potentially affected by the following security issues : 

  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2009-01)

  - Cookies marked HTTPOnly are readable by JavaScript via the 'XMLHttpRequest.getResponseHeader' and 'XMLHttpRequest.getAllResponseHeaders' APIs. (MFSA 2009-05)

  - By exploiting stability bugs in the browser engine, it might be possible for an attacker to execute arbitrary code on the remote system under certain conditions. (MFSA 2009-07)

  - It may be possible for a website to read arbitrary XML data from another domain by using nsIRDFService and a cross-domain redirect. (MFSA 2009-09)

  - Vulnerabilities in the PNG libraries used by Mozilla could be exploited to execute arbitrary code on the remote system. (MFSA 2009-10)

Versions of Mozilla Thunderbird prior to 2.0.0.21 are affected by the following vulnerabilities :

 - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2009-01)
 - By exploiting stability bugs in the browser engine, it might be possible for an attacker to execute arbitrary code on the remote system under certain conditions. (MFSA 2009-07)
 - It may be possible for a website to read arbitrary XML data from another domain by using nsIRDFService and a cross-domain redirect. (MFSA 2009-09)
 - Vulnerabilities in the PNG libraries used by Mozilla could be exploited to execute arbitrary code on the remote system. (MFSA 2009-10)

An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775)

Several flaws were found in the way malformed content was processed. A website containing specially crafted content could, potentially, trick a Firefox user into surrendering sensitive information.
(CVE-2009-0776, CVE-2009-0777)

For technical details regarding these flaws, please see the Mozilla security advisories for Firefox 3.0.7. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.7, and which correct these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Versions of Firefox prior to 3.0.7 are affected by the following security issues : 

 - By exploiting stability bugs in the browser engine, it might be possible for an attacker to execute arbitrary code on the remote system under certain conditions.  (MFSA 2009-07)
 - A vulnerability in Mozilla's garbage collection process could be exploited to run arbitrary code on the remote system. (MFSA 2009-08)
 - It may be possible for a website to read arbitrary XML data from another domain by using 'nsIRDFService' and a cross-domain redirect. (MFSA 2009-09)
 - Vulnerabilities in the PNG libraries used by Mozilla could be exploited to execute arbitrary code on the remote system. (MFSA 2009-10)
 - Certain invisible characters are decoded before being displayed on the location bar. An attacker may be able to exploit this flaw to spoof the location bar and display a link to a malicious URL. (MFSA 2009-11).

The installed version of Firefox 3.0.x is earlier than 3.0.7. Such versions are potentially affected by the following security  issues :

  - By exploiting stability bugs in the browser engine, it     might be possible for an attacker to execute arbitrary     code on the remote system under certain conditions.     (MFSA 2009-07)

  - A vulnerability in Mozilla's garbage collection process     could be exploited to run arbitrary code on the remote     system. (MFSA 2009-08)

  - It may be possible for a website to read arbitrary XML     data from another domain by using nsIRDFService and a     cross-domain redirect. (MFSA 2009-09)

  - Vulnerabilities in the PNG libraries used by Mozilla     could be exploited to execute arbitrary code on the     remote system. (MFSA 2009-10)

  - Certain invisible characters are decoded before being     displayed on the location bar. An attacker may be able     to exploit this flaw to spoof the location bar and     display a link to a malicious URL. (MFSA 2009-11)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0315 advisory.

  - libpng arbitrary free() flaw (CVE-2009-0040)

  - Firefox 3 Layout Engine Crashes (CVE-2009-0771)

  - Firefox 2 and 3 - Layout engine crashes (CVE-2009-0772)

  - Firefox 3 crashes in the JavaScript engine (CVE-2009-0773)

  - Firefox 2 and 3 crashes in the JavaScript engine (CVE-2009-0774)

  - Firefox XUL Linked Clones Double Free Vulnerability (CVE-2009-0775)

  - Firefox XML data theft via RDFXMLDataSource and cross-domain redirect (CVE-2009-0776)

  - Firefox URL spoofing with invisible control characters (CVE-2009-0777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Thunderbird is earlier than 2.0.0.21.  Such versions are potentially affected by the following security issues : 

  - There are several stability bugs in the browser engine that may lead to crashes with evidence of memory corruption. (MFSA 2009-01)

  - By exploiting stability bugs in the browser engine, it might be possible for an attacker to execute arbitrary code on the remote system under certain conditions.  (MFSA 2009-07)

  - It may be possible for a website to read arbitrary XML data from another domain by using nsIRDFService and a cross-domain redirect. (MFSA 2009-09)

  - Vulnerabilities in the PNG libraries used by Mozilla could be exploited to execute arbitrary code on the remote system. (MFSA 2009-10)

The installed version of Firefox is earlier than 3.0.7. Such versions are potentially affected by the following security issues : 

  - By exploiting stability bugs in the browser engine, it might be possible for an attacker to execute arbitrary code on the remote system under certain conditions.  (MFSA 2009-07)

  - A vulnerability in Mozilla's garbage collection process could be exploited to run arbitrary code on the remote system. (MFSA 2009-08)

  - It may be possible for a website to read arbitrary XML data from another domain by using nsIRDFService and a cross-domain redirect. (MFSA 2009-09)

  - Vulnerabilities in the PNG libraries used by Mozilla could be exploited to execute arbitrary code on the remote system. (MFSA 2009-10)

  - Certain invisible characters are decoded before being displayed on the location bar. An attacker may be able to exploit this flaw to spoof the location bar and display a link to a malicious URL. (MFSA 2009-11).

ID	Name	Product	Family	Severity
67810	Oracle Linux 5 : firefox (ELSA-2009-0315)	Nessus	Oracle Linux Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
60538	Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
41352	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 656)	Nessus	SuSE Local Security Checks	critical
40170	openSUSE Security Update : MozillaFirefox (MozillaFirefox-591)	Nessus	SuSE Local Security Checks	critical
39887	openSUSE Security Update : MozillaFirefox (MozillaFirefox-591)	Nessus	SuSE Local Security Checks	critical
38036	Ubuntu 8.04 LTS / 8.10 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-728-1)	Nessus	Ubuntu Local Security Checks	critical
37610	Mandriva Linux Security Advisory : firefox (MDVSA-2009:075)	Nessus	Mandriva Local Security Checks	critical
36866	Fedora 10 : Miro-2.0-4.fc10 / blam-1.8.5-7.fc10 / devhelp-0.22-5.fc10 / epiphany-2.24.3-3.fc10 / etc (2009-2422)	Nessus	Fedora Local Security Checks	critical
4965	SeaMonkey < 1.1.15 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
4964	Mozilla Thunderbird < 2.0.0.21 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	medium
35802	Fedora 9 : Miro-1.2.7-5.fc9 / blam-1.8.5-6.fc9.1 / chmsee-1.0.1-9.fc9 / devhelp-0.19.1-9.fc9 / etc (2009-2421)	Nessus	Fedora Local Security Checks	critical
35789	CentOS 4 / 5 : firefox (CESA-2009:0315)	Nessus	CentOS Local Security Checks	critical
4950	Mozilla Firefox < 3.0.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
35778	Firefox 3.0.x < 3.0.7 Multiple Vulnerabilities	Nessus	Windows	high
35773	RHEL 4 / 5 : firefox (RHSA-2009:0315)	Nessus	Red Hat Local Security Checks	critical
801212	Mozilla Thunderbird < 2.0.0.21 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
800869	SeaMonkey < 1.1.15 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800743	Firefox < 3.0.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2009-0777

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

critical

critical

medium

high

critical

high

high

high