Firefox < 3.0.9 Multiple Vulnerabilities

high Nessus Plugin ID 36215

Synopsis

The remote Windows host contains a web browser that is affected by multiple vulnerabilities.

Description

The installed version of Firefox is earlier than 3.0.9. Such versions are potentially affected by the following security issues :

- Multiple remote memory corruption vulnerabilities exist that can be exploited to execute arbitrary code in the context of the user running the affected application.
(MFSA 2009-14)

- A flaw may exist where Unicode box drawing characters are allowed in Internationalized Domain Names where they could be visually confused with punctuation used in valid web addresses. An attacker can leverage this to launch a phishing-type scam against a victim. (MFSA 2009-15)

- A vulnerability exists when the 'jar:' scheme is used to wrap a URI which serves the content with 'Content-Disposition: attachment'. An attacker can leverage this to subvert sites that use this mechanism to mitigate content injection attacks. (MFSA 2009-16)
- When an Adobe Flash file is loaded via the 'view-source:' scheme, the Flash plugin misinterprets the origin of the content as localhost. An attacker can leverage this to launch cross-site request forgery attacks. It is also possible to exploit this to place cookie-like objects on victim's computers.
(MFSA 2009-17)

- A vulnerability exists that allows attackers to inject arbitrary scripts into sites via XBL bindings. This vulnerability requires the attacker to have the ability to embed third-party stylesheets into the site. (MFSA 2009-18)

- Multiple remote code execution vulnerabilities exist caused by the creation of documents whose URI does not match the document's principle using XMLHttpRequest, as well as a flaw in the 'XPCNativeWrapper.ToString' '__proto__' coming from the wrong scope. (MFSA 2009-19)

- A malicious MozSearch plugin could be created using a javascript: URI in the SearchForm value. An attacker can leverage this in order to inject code into arbitrary sites. (MFSA 2009-20)

- An information disclosure vulnerability exists when saving the inner frame of a web page as a file when the outer page has POST data associated with it. (MFSA 2009-21)

- A cross-site scripting vulnerability exists when handling a Refresh header containing a javascript: URI.
(MFSA 2009-22)

Solution

Upgrade to Firefox 3.0.9 or later.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2009-14/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-15/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-16/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-17/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-18/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-19/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-20/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-21/

https://www.mozilla.org/en-US/security/advisories/mfsa2009-22/

Plugin Details

Severity: High

ID: 36215

File Name: mozilla_firefox_309.nasl

Version: 1.20

Type: local

Agent: windows

Family: Windows

Published: 4/22/2009

Updated: 7/17/2018

Supported Sensors: Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:mozilla:firefox

Required KB Items: Mozilla/Firefox/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/21/2009

Reference Information

CVE: CVE-2009-0652, CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305, CVE-2009-1306, CVE-2009-1307, CVE-2009-1308, CVE-2009-1309, CVE-2009-1310, CVE-2009-1311, CVE-2009-1312

BID: 33837, 34656

CWE: 16, 20, 200, 399, 79