SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips
 

Vulnerability Note VU#592425

Mozilla-based products fail to validate user input to the attribute name in "XULDocument.persist"

Overview

A vulnerability in some Mozilla products that could allow a remote attacker to execute Javascript commands with the permissions of the user running the affected application.

I. Description

According to the Mozilla advisory on this issue:

    XULDocument.persist() did not validate the attribute name, allowing an attacker to inject XML into localstore.rdf that would be read and acted upon at startup. This could include JavaScript commands that would be run with the permissions of the browser.

    Note: Thunderbird could be vulnerable if JavaScript is enabled. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration.


This vulnerability affects Mozilla Firefox, SeaMonkey, Thunderbird, and potentially any other Mozilla-based application. The exploit code for this vulnerability could be remotely supplied through a web page or in an email message.

II. Impact

A remote attacker may be able to inject XML code, including JavaScript commands, into a startup file on the victim's system. This file would then be read and executed the next time the affected application is started.

III. Solution

Upgrade


Mozilla has released Firefox version 1.5.0.1 that contains a fix for this issue. The SeaMonkey project has released version 1.0 that contains a fix for this issue. Users are strongly encouraged to upgrade to these fixed versions of the software.

Systems Affected

VendorStatusDate Updated
Fedora ProjectVulnerable3-Feb-2006
Mandriva, Inc.Vulnerable8-Feb-2006
Mozilla, Inc.Unknown7-Feb-2006
Red Hat, Inc.Vulnerable8-Feb-2006

References


http://www.mozilla.org/security/announce/mfsa2006-05.html
https://rhn.redhat.com/errata/RHSA-2006-0199.html
https://rhn.redhat.com/errata/RHSA-2006-0200.html
FEDORA-2006-075
FEDORA-2006-076
http://www.securityfocus.com/bid/16476
http://secunia.com/advisories/18700
http://secunia.com/advisories/18703
http://secunia.com/advisories/18704
http://www.auscert.org.au/6000
http://www.auscert.org.au/6001

Credit

Thanks to the Mozilla Corporation for reporting this vulnerability. Mozilla, in turn, credits moz_bug_r_a4 with reporting this issue to them.

This document was written by Chad R Dougherty.

Other Information

Date Public02/02/2006
Date First Published02/03/2006 05:03:11 PM
Date Last Updated02/08/2006
CERT Advisory 
CVE NameCVE-2006-0296
US-CERT Technical Alerts 
Metric17.10
Document Revision16

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader