Vulnerability Note VU#592425
Mozilla-based products fail to validate user input to the attribute name in "XULDocument.persist"
Overview
A vulnerability in some Mozilla products that could allow a remote attacker to execute Javascript commands with the permissions of the user running the affected application.
Description
According to the Mozilla advisory on this issue: XULDocument.persist() did not validate the attribute name, allowing an attacker to inject XML into localstore.rdf that would be read and acted upon at startup. This could include JavaScript commands that would be run with the permissions of the browser. Note: Thunderbird could be vulnerable if JavaScript is enabled. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration. This vulnerability affects Mozilla Firefox, SeaMonkey, Thunderbird, and potentially any other Mozilla-based application. The exploit code for this vulnerability could be remotely supplied through a web page or in an email message. |
Impact
A remote attacker may be able to inject XML code, including JavaScript commands, into a startup file on the victim's system. This file would then be read and executed the next time the affected application is started. |
Solution
Upgrade |
Systems Affected (Learn More)
Vendor | Status | Date Notified | Date Updated |
---|---|---|---|
Fedora Project | Affected | - | 03 Feb 2006 |
Mandriva, Inc. | Affected | - | 08 Feb 2006 |
Red Hat, Inc. | Affected | - | 08 Feb 2006 |
Mozilla, Inc. | Unknown | 07 Feb 2006 | 07 Feb 2006 |
CVSS Metrics (Learn More)
Group | Score | Vector |
---|---|---|
Base | N/A | N/A |
Temporal | N/A | N/A |
Environmental | N/A | N/A |
References
- http://www.mozilla.org/security/announce/mfsa2006-05.html
- https://rhn.redhat.com/errata/RHSA-2006-0199.html
- https://rhn.redhat.com/errata/RHSA-2006-0200.html
- FEDORA-2006-075
- FEDORA-2006-076
- http://www.securityfocus.com/bid/16476
- http://secunia.com/advisories/18700
- http://secunia.com/advisories/18703
- http://secunia.com/advisories/18704
- http://www.auscert.org.au/6000
- http://www.auscert.org.au/6001
Credit
Thanks to the Mozilla Corporation for reporting this vulnerability. Mozilla, in turn, credits moz_bug_r_a4 with reporting this issue to them.
This document was written by Chad R Dougherty.
Other Information
- CVE IDs: CVE-2006-0296
- Date Public: 02 Feb 2006
- Date First Published: 03 Feb 2006
- Date Last Updated: 08 Feb 2006
- Severity Metric: 17.10
- Document Revision: 16
Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.