Detections
Analytics

Ubuntu 9.04 / 9.10 : firefox, firefox-3.0, xulrunner-1.9.2 vulnerability (USN-930-6)

critical Nessus Plugin ID 47855

Language:

Synopsis

The remote Ubuntu host is missing one or more security-related patches.

Description

USN-957-1 fixed vulnerabilities in Firefox and Xulrunner. Daniel Holbert discovered that the fix for CVE-2010-1214 introduced a regression which did not properly initialize a plugin pointer. If a user were tricked into viewing a malicious site, a remote attacker could use this to crash the browser or run arbitrary code as the user invoking the program. (CVE-2010-2755)

This update fixes the problem.

If was discovered that Firefox could be made to access freed memory.
If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2010-1121)

Several flaws were discovered in the browser engine of Firefox. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1200, CVE-2010-1201, CVE-2010-1202, CVE-2010-1203)

A flaw was discovered in the way plugin instances interacted. An attacker could potentially exploit this and use one plugin to access freed memory from a second plugin to execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1198)

An integer overflow was discovered in Firefox. If a user were tricked into viewing a malicious site, an attacker could overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1196)

Martin Barbella discovered an integer overflow in an XSLT node sorting routine. An attacker could exploit this to overflow a buffer and cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-1199)

Michal Zalewski discovered that the focus behavior of Firefox could be subverted. If a user were tricked into viewing a malicious site, a remote attacker could use this to capture keystrokes. (CVE-2010-1125)

Ilja van Sprundel discovered that the 'Content-Disposition:
attachment' HTTP header was ignored when 'Content-Type:
multipart' was also present. Under certain circumstances, this could potentially lead to cross-site scripting attacks.
(CVE-2010-1197)

Amit Klein discovered that Firefox did not seed its random number generator often enough. An attacker could exploit this to identify and track users across different websites.
(CVE-2008-5913).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

See Also

https://usn.ubuntu.com/930-6/

Plugin Details

Severity: Critical

ID: 47855

File Name: ubuntu_USN-930-6.nasl

Version: 1.13

Type: local

Agent: unix

Published: 7/27/2010

Updated: 9/19/2019

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-dom-inspector, p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso-gnome-support, p-cpe:/a:canonical:ubuntu_linux:firefox-3.1-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-3.1-dev, p-cpe:/a:canonical:ubuntu_linux:abrowser-3.5, p-cpe:/a:canonical:ubuntu_linux:abrowser-3.5-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-3.5-dev, p-cpe:/a:canonical:ubuntu_linux:abrowser-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-gnome-support, p-cpe:/a:canonical:ubuntu_linux:firefox-dbg, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9.2-testsuite, cpe:/o:canonical:ubuntu_linux:9.04, cpe:/o:canonical:ubuntu_linux:9.10, p-cpe:/a:canonical:ubuntu_linux:abrowser-3.0, p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-3.0, p-cpe:/a:canonical:ubuntu_linux:firefox-3.1-dbg, p-cpe:/a:canonical:ubuntu_linux:firefox-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-trunk, p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-gnome-support, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9, p-cpe:/a:canonical:ubuntu_linux:firefox-3.1-gnome-support, p-cpe:/a:canonical:ubuntu_linux:firefox-dev, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9.2-dbg, p-cpe:/a:canonical:ubuntu_linux:firefox-3.5-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-dev, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9.2-dev, p-cpe:/a:canonical:ubuntu_linux:firefox-3.5-dbg, p-cpe:/a:canonical:ubuntu_linux:firefox-trunk-dev, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9.2-testsuite-dev, p-cpe:/a:canonical:ubuntu_linux:xulrunner-dev, p-cpe:/a:canonical:ubuntu_linux:abrowser-3.0-branding, p-cpe:/a:canonical:ubuntu_linux:abrowser-3.1, p-cpe:/a:canonical:ubuntu_linux:firefox-3.0-venkman, p-cpe:/a:canonical:ubuntu_linux:abrowser-3.1-branding, p-cpe:/a:canonical:ubuntu_linux:firefox-gnome-support-dbg, p-cpe:/a:canonical:ubuntu_linux:firefox-trunk-gnome-support, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9.2-gnome-support, p-cpe:/a:canonical:ubuntu_linux:abrowser, p-cpe:/a:canonical:ubuntu_linux:firefox-3.5-gnome-support, p-cpe:/a:canonical:ubuntu_linux:firefox-3.1, p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso, p-cpe:/a:canonical:ubuntu_linux:firefox-granparadiso-dev, p-cpe:/a:canonical:ubuntu_linux:firefox-libthai, p-cpe:/a:canonical:ubuntu_linux:firefox-3.5, p-cpe:/a:canonical:ubuntu_linux:firefox, p-cpe:/a:canonical:ubuntu_linux:xulrunner-1.9.2, p-cpe:/a:canonical:ubuntu_linux:firefox-dom-inspector

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Patch Publication Date: 7/26/2010

Vulnerability Publication Date: 1/20/2009

Reference Information

CVE: CVE-2008-5913, CVE-2010-1121, CVE-2010-1125, CVE-2010-1196, CVE-2010-1197, CVE-2010-1198, CVE-2010-1199, CVE-2010-1200, CVE-2010-1201, CVE-2010-1202, CVE-2010-1203, CVE-2010-1214, CVE-2010-2755

USN: 930-6