search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Mozilla allows signed scripts calling "enablePrivilege" to change contents of a "grant" dialog

Vulnerability Note VU#113192

Original Release Date: 2004-09-17 | Last Revised: 2004-10-26

Overview

A vulnerability in the way Mozilla and its derived programs display dialogs in some circumstances could allow a remote attacker to install and run software on a vulnerable system.

Description

The Mozilla web browser and related Mozilla products support the ability to run signed scripts supplied in HTML email or webpages. A signed script can request expanded privileges that give it access to restricted information and abilities by using the enablePrivilege method. A deficiency in the way that these products create dialog boxes via enablePrivilege allows a malicious script to supply a string including spaces and normal text for the dialog box. A malicious signed script requesting enhanced abilities could construct the request in a way that possibly fooled the user into thinking the privilege requested was inconsequential while actually obtaining explicit permission to run and install software. The user would still be required to explicitly click "Ok" in the grant dialog for exploitation of this issue to be successful.

Impact

By convincing a victim to accept a signed script, a remote attacker may be able to install and run software with the privileges of the user running an affected program.

Solution

Upgrade to a fixed version of the affected software

The Mozilla Project has released new versions of the affected software that include patches for this vulnerability. Please see the Systems Affected section of this document for more information.

Workarounds


Users who are unable to upgrade to a patched version of the software are encouraged to apply the following workarounds:

    • Disable Javascript
    • Never grant enhanced abilities of any kind to untrusted web pages (this workaround comes from from the Mozilla project advisory about this issue)

Vendor Information

113192
Expand all

Conectiva

Updated:  October 26, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Conectiva security team has published Conectiva Linux Security Announcement CLSA-2004:877 in response to this issue. Users are encouraged to review this announcement and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Gentoo

Updated:  October 26, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Gentoo development team has published Gentoo Linux Security Advisory 200409-26 in response to this issue. Users are encouraged to review this advisory and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Mozilla

Updated:  September 17, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Mozilla project has released the following versions of the affected software that contain a patch for this issue:


Users are strongly encouraged to upgrade to one of these versions.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

SuSE Inc.

Updated:  October 26, 2004

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The SuSE Security Team has published SUSE Security Announcement SUSE-SA:2004:036 in response to this issue. Users are encouraged to review this announcement and apply the patches it refers to.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

AOL Time Warner

Updated:  September 20, 2004

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NETscape Communications Corporation

Updated:  September 20, 2004

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Information about this issue was originally published by the Mozilla Project . The Mozilla Project, in turn, credits Jesse Ruderman with the discovery and reporting of this issue

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 6.21
Date Public: 2004-09-14
Date First Published: 2004-09-17
Date Last Updated: 2004-10-26 15:26 UTC
Document Revision: 8

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.