| VID |
28775 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
A version of Mozilla Firefox which is older than 3.0.11 has been installed on the host. Mozilla is an open-source based Web browser, developed by the Mozilla project. Mozilla Firefox versions 3.0.x prior to 3.0.11 are vulnerable to multiple vulnerabilities.
- Multiple memory corruption vulnerabilities could potentially be exploited to execute arbitrary code.
- Certain invalid Unicode characters, when used as a part of IDN, can be displayed as a whitespace in the location bar. An attacker can exploit this vulnerability to poof the location bar.
- It may be possible for local resources loaded via 'file:' protocol to access any domain's cookies saved on a user's system.
- It may be possible to tamper with SSL data via non-200 responses to proxy CONNECT requests.
- A race condition exists in 'NPObjWrapper_NewResolve' when accessing the properties of a NPObject, a wrapped JSObject. This flaw could be potentially exploited to execute arbitrary code on the remote system.
- If the owner document of an element becomes null after garbage collection, then it may be possible to execute the event listeners within the wrong JavaScript context. An attacker can potentially exploit this vulnerability to execute arbitrary JavaScript with chrome privileges.
- When the 'file:' resource is loaded from the location bar, the resource inherits principal of the previously loaded document. This could potentially allow unauthorized access to local files.
- While loading external scripts into XUL documents content-loading policies are not checked.
- It may be possible for scripts from page content to run with elevated privileges.
* Note: This check requires an account with Guest or upper privileges which can access the registry of the remote host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts
* References:
http://research.microsoft.com/apps/pubs/default.aspx?id=79323
http://www.mozilla.org/security/announce/2009/mfsa2009-24.html
http://www.mozilla.org/security/announce/2009/mfsa2009-25.html
http://www.mozilla.org/security/announce/2009/mfsa2009-26.html
http://www.mozilla.org/security/announce/2009/mfsa2009-27.html
http://www.mozilla.org/security/announce/2009/mfsa2009-28.html
http://www.mozilla.org/security/announce/2009/mfsa2009-29.html
http://www.mozilla.org/security/announce/2009/mfsa2009-30.html
http://www.mozilla.org/security/announce/2009/mfsa2009-31.html
http://www.mozilla.org/security/announce/2009/mfsa2009-32.html
* Platforms Affected:
Mozilla Project, Firefox versions 3.0.x prior to 3.0.11
Microsoft Windows Any version
Unix Any versio |
| Recommendation |
Upgrade to the latest version of Firefox (3.0.11 or later), available from the Mozilla Firefox Download Web page at http://www.mozilla.org/products/firefox/ |
| Related URL |
CVE-2009-1392,CVE-2009-1832,CVE-2009-1833,CVE-2009-1834,CVE-2009-1835,CVE-2009-1836,CVE-2009-1837,CVE-2009-1838,CVE-2009-1839,CVE-2009-1840 (CVE) |
| Related URL |
35360,35370,35371,35372,35373,35377,35380,35383,35386,35388,35391 (SecurityFocus) |
| Related URL |
(ISS) |
|
