The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper.

From Red Hat Security Advisory 2009:1162 :

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.12. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The remote host is affected by the vulnerability described in GLSA-201301-01 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox,       Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition. Furthermore, a remote attacker may be able       to perform Man-in-the-Middle attacks, obtain sensitive information,       bypass restrictions and protection mechanisms, force file downloads,       conduct XML injection attacks, conduct XSS attacks, bypass the Same       Origin Policy, spoof URL&rsquo;s for phishing attacks, trigger a vertical       scroll, spoof the location bar, spoof an SSL indicator, modify the       browser&rsquo;s font, conduct clickjacking attacks, or have other unspecified       impact.
    A local attacker could gain escalated privileges, obtain sensitive       information, or replace an arbitrary downloaded file.
  Workaround :

    There is no known workaround at this time.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2462     Martijn Wargers, Arno Renevier, Jesse Ruderman, Olli     Pettay and Blake Kaplan discovered several issues in the     browser engine that could potentially lead to the     execution of arbitrary code. (MFSA 2009-34)

  - CVE-2009-2463     monarch2020 reported an integer overflow in a base64     decoding function. (MFSA 2009-34)

  - CVE-2009-2464     Christophe Charron reported a possibly exploitable crash     occurring when multiple RDF files were loaded in a XUL     tree element. (MFSA 2009-34)

  - CVE-2009-2465     Yongqian Li reported that an unsafe memory condition     could be created by specially crafted document. (MFSA     2009-34)

  - CVE-2009-2466     Peter Van der Beken, Mike Shaver, Jesse Ruderman, and     Carsten Book discovered several issues in the JavaScript     engine that could possibly lead to the execution of     arbitrary JavaScript. (MFSA 2009-34)

  - CVE-2009-2467     Attila Suszter discovered an issue related to a     specially crafted Flash object, which could be used to     run arbitrary code. (MFSA 2009-35)

  - CVE-2009-2469     PenPal discovered that it is possible to execute     arbitrary code via a specially crafted SVG element.
    (MFSA 2009-37)

  - CVE-2009-2471     Blake Kaplan discovered a flaw in the JavaScript engine     that might allow an attacker to execute arbitrary     JavaScript with chrome privileges. (MFSA 2009-39)

  - CVE-2009-2472     moz_bug_r_a4 discovered an issue in the JavaScript     engine that could be used to perform cross-site     scripting attacks. (MFSA 2009-40)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466, CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript code. A website containing malicious content could launch a cross-site scripting (XSS) attack or execute arbitrary JavaScript with the permissions of another website. (CVE-2009-2472)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.0.12. You can find a link to the Mozilla advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.12, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

The MozillaFirefox 3.0.12 release fixes various bugs and some critical security issues.

MFSA 2009-34 / CVE-2009-2462 / CVE-2009-2463 / CVE-2009-2464 / CVE-2009-2465 / CVE-2009-2466: Mozilla developers and community members identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

MFSA 2009-35 / CVE-2009-2467: Security researcher Attila Suszter reported that when a page contains a Flash object which presents a slow script dialog, and the page is navigated while the dialog is still visible to the user, the Flash plugin is unloaded resulting in a crash due to a call to the deleted object. This crash could potentially be used by an attacker to run arbitrary code on a victim's computer.

MFSA 2009-36 / CVE-2009-1194: oCERT security researcher Will Drewry reported a series of heap and integer overflow vulnerabilities which independently affected multiple font glyph rendering libraries. On Linux platforms libpango was susceptible to the vulnerabilities while on OS X CoreGraphics was similarly vulnerable. An attacker could trigger these overflows by constructing a very large text run for the browser to display. Such an overflow can result in a crash which the attacker could potentially use to run arbitrary code on a victim's computer. The open-source nature of Linux meant that Mozilla was able to work with the libpango maintainers to implement the correct fix in version 1.24 of that system library which was distributed with OS security updates. On Mac OS X Firefox works around the CoreGraphics flaw by limiting the length of text runs passed to the system.

MFSA 2009-37 / CVE-2009-2469: Security researcher PenPal reported a crash involving a SVG element on which a watch function and
__defineSetter__ function have been set for a particular property. The crash showed evidence of memory corruption and could potentially be used by an attacker to run arbitrary code on a victim's computer.

MFSA 2009-39 / CVE-2009-2471: Mozilla developer Blake Kaplan reported that setTimeout, when called with certain object parameters which should be protected with a XPCNativeWrapper, will fail to keep the object wrapped when compiling the new function to be executed. If chrome privileged code were to call setTimeout using this as an argument, the this object will lose its wrapper and could be unsafely accessed by chrome code. An attacker could use such vulnerable code to run arbitrary JavaScript with chrome privileges.

MFSA 2009-40 / CVE-2009-2472: Mozilla security researcher moz_bug_r_a4 reported a series of vulnerabilities in which objects that normally receive a XPCCrossOriginWrapper are constructed without the wrapper.
This can lead to cases where JavaScript from one website may unsafely access properties of such an object which had been set by a different website. A malicious website could use this vulnerability to launch a XSS attack and run arbitrary JavaScript within the context of another site.

The Mozilla Firefox 3.0.12 release fixes various bugs and some critical security issues.

  - Mozilla developers and community members identified and     fixed several stability bugs in the browser engine used     in Firefox and other Mozilla-based products. Some of     these crashes showed evidence of memory corruption under     certain circumstances and we presume that with enough     effort at least some of these could be exploited to run     arbitrary code. (MFSA 2009-34 / CVE-2009-2462 /     CVE-2009-2463 / CVE-2009-2464 / CVE-2009-2465 /     CVE-2009-2466)

  - Security researcher Attila Suszter reported that when a     page contains a Flash object which presents a slow     script dialog, and the page is navigated while the     dialog is still visible to the user, the Flash plugin is     unloaded resulting in a crash due to a call to the     deleted object. This crash could potentially be used by     an attacker to run arbitrary code on a victim's     computer. (MFSA 2009-35 / CVE-2009-2467)

  - oCERT security researcher Will Drewry reported a series     of heap and integer overflow vulnerabilities which     independently affected multiple font glyph rendering     libraries. On Linux platforms libpango was susceptible     to the vulnerabilities while on OS X CoreGraphics was     similarly vulnerable. An attacker could trigger these     overflows by constructing a very large text run for the     browser to display. Such an overflow can result in a     crash which the attacker could potentially use to run     arbitrary code on a victim's computer. The open source     nature of Linux meant that Mozilla was able to work with     the libpango maintainers to implement the correct fix in     version 1.24 of that system library which was     distributed with OS security updates. On Mac OS X     Firefox works around the CoreGraphics flaw by limiting     the length of text runs passed to the system. (MFSA     2009-36 / CVE-2009-1194)

  - Security researcher PenPal reported a crash involving a     SVG element on which a watch function and
    __defineSetter__ function have been set for a particular     property. The crash showed evidence of memory corruption     and could potentially be used by an attacker to run     arbitrary code on a victim's computer. (MFSA 2009-37 /     CVE-2009-2469)

  - Mozilla developer Blake Kaplan reported that setTimeout,     when called with certain object parameters which should     be protected with a XPCNativeWrapper, will fail to keep     the object wrapped when compiling the new function to be     executed. If chrome privileged code were to call     setTimeout using this as an argument, the this object     will lose its wrapper and could be unsafely accessed by     chrome code. An attacker could use such vulnerable code     to run arbitrary JavaScript with chrome privileges.
    (MFSA 2009-39 / CVE-2009-2471)

  - Mozilla security researcher moz_bug_r_a4 reported a     series of vulnerabilities in which objects that normally     receive a XPCCrossOriginWrapper are constructed without     the wrapper. This can lead to cases where JavaScript     from one website may unsafely access properties of such     an object which had been set by a different website. A     malicious website could use this vulnerability to launch     a XSS attack and run arbitrary JavaScript within the     context of another site. (MFSA 2009-40 / CVE-2009-2472)

The installed version of Firefox is earlier than 3.0.12. Such versions are potentially affected by the following security issues :

  - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-34)

  - It may be possible to crash the browser or potentially execute arbitrary code by using a flash object that presents a slow script dialog. (MFSA 2009-35)

  - Glyph rendering libraries are affected by multiple heap/integer overflows. (MFSA 2009-36)

  - A vulnerability involving SVG element could be exploited to crash the browser or execute arbitrary code on the remote system. (MFSA 2009-37)

  - A vulnerability in 'setTimeout' could allow unsafe access to the 'this' object from chrome code. An attacker could exploit this flaw to run arbitrary JavaScript with chrome privileges. (MFSA 2009-39)

  - It may be possible for JavaScript from one website to bypass cross-origin wrapper, and unsafely access properties of an object from another website. (MFSA 2009-40)

Versions of Firefox prior to 3.0.12 are affected by the following security issues :

 - Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code. (MFSA 2009-34)
 - It may be possible to crash the browser or potentially execute arbitrary code by using a flash object that presents a slow script dialog. (MFSA 2009-35)
 - Glyph rendering libraries are affected by multiple heap/integer overflows. (MFSA 2009-36)
 - A vulnerability involving SVG element could be exploited to crash the browser or execute arbitrary code on the remote system. (MFSA 2009-37)
 - A vulnerability in 'setTimeout' could allow unsafe access to the 'this' object from chrome code. An attacker could exploit this flaw to run arbitrary JavaScript with chrome privileges. (MFSA 2009-39)
 - It may be possible for JavaScript from one website to bypass cross-origin wrapper, and unsafely access properties of an object from another website. (MFSA 2009-40)  

Update to new upstream Firefox version 3.0.12, fixing multiple security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.12 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of Firefox is earlier than 3.0.12. Such versions are potentially affected by the following security issues :

  - Multiple memory corruption vulnerabilities could     potentially be exploited to execute arbitrary code.     (MFSA 2009-34)

  - It may be possible to crash the browser or potentially     execute arbitrary code by using a flash object that     presents a slow script dialog. (MFSA 2009-35) 

  - Glyph rendering libraries are affected by multiple heap/     integer overflows. (MFSA 2009-36)

  - A vulnerability involving SVG element could be exploited     to crash the browser or execute arbitrary code on the     remote system. (MFSA 2009-37)

  - A SOCKS5 proxy that replies with a hostname containing     more than 15 characters can corrupt the subsequent     data stream.  This can lead to a denial of service,     though there is reportedly no memory corruption.
    (MFSA 2009-38)

  - A vulnerability in 'setTimeout' could allow unsafe     access to the 'this' object from chrome code. An     attacker could exploit this flaw to run arbitrary     JavaScript with chrome privileges. (MFSA 2009-39)

  - It may be possible for JavaScript from one website     to bypass cross origin wrapper, and unsafely access     properties of an object from another website.
    (MFSA 2009-40)

ID	Name	Product	Family	Severity
67893	Oracle Linux 4 / 5 : firefox (ELSA-2009-1162)	Nessus	Oracle Linux Local Security Checks	critical
63402	GLSA-201301-01 : Mozilla Products: Multiple vulnerabilities (BEAST)	Nessus	Gentoo Local Security Checks	critical
62808	Scientific Linux Security Update : firefox on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
60619	Scientific Linux Security Update : firefox on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
60618	Scientific Linux Security Update : firefox on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
44705	Debian DSA-1840-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	critical
43769	CentOS 5 : firefox (CESA-2009:1162)	Nessus	CentOS Local Security Checks	critical
41983	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-6379)	Nessus	SuSE Local Security Checks	critical
41357	SuSE 11 Security Update : MozillaFirefox (SAT Patch Number 1134)	Nessus	SuSE Local Security Checks	critical
800767	Firefox < 3.0.12 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
5101	Mozilla Firefox < 3.0.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
40404	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1135)	Nessus	SuSE Local Security Checks	critical
40403	openSUSE Security Update : MozillaFirefox (MozillaFirefox-1135)	Nessus	SuSE Local Security Checks	critical
40358	Fedora 10 : Miro-2.0.5-2.fc10 / blam-1.8.5-12.fc10 / devhelp-0.22-10.fc10 / epiphany-2.24.3-8.fc10 / etc (2009-7961)	Nessus	Fedora Local Security Checks	critical
40351	Firefox < 3.0.12 Multiple Vulnerabilities	Nessus	Windows	high
40340	RHEL 4 / 5 : firefox (RHSA-2009:1162)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2009-2471

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

medium

critical

critical

critical

high

critical