Technical Description

Nine vulnerabilities were identified in Mozilla Suite and Mozilla Firefox, which may be exploited by remote attackers to execute arbitrary commands or conduct spoofing and cross site scripting attacks.

The first flaw is due to a buffer overflow error when handling malformed URLs containing "soft hyphen" characters, which could be exploited by remote attackers to take complete control of an affected system via specially crafted Web pages. For additional information, see : VUPEN/ADV-2005-1690

The second vulnerability is due to a heap overflow error when processing specially crafted XBM images, which could be exploited by malicious websites to compromise a vulnerable system.

The third flaw is due to a stack corruption error when processing Unicode sequences with ZWNJ (zero-width non-joiner) characters, which could be exploited by malicious websites to execute arbitrary commands.

The fourth issue occurs when malformed headers are added to an XMLHttpRequest, which could be exploited by attackers to bypass certain security restrictions.

The fifth flaw is due to an error where unprivileged controls from web content can implement XPCOM interfaces, which could be exploited by attackers to execute arbitrary scripts with elevated privileges.

The sixth vulnerability is due to an integer overflow error in the JavaScript engine, which could be exploited by malicious websites to compromise a vulnerable system.

The seventh flaw is due to an error where high privileged "chrome" pages could be loaded from an unprivileged "about:" page, which may be combined with a same-origin violation and exploited to execute arbitrary commands.

The eighth vulnerability is due to an error when opening and handling a specially crafted window, which could be exploited by attackers to bypass certain security features and conduct spoofing attacks.

The ninth issue is due to an input validation error when processing specially crafted URLs containing malicious shell commands enclosed within backquote characters, which could be exploited by remote attackers to compromise a vulnerable system. For additional information, see : VUPEN/ADV-2005-1794

Affected Products

Mozilla Firefox version 1.0.6 and prior
Mozilla Suite version 1.7.11 and prior
Mozilla Thunderbird version 1.0.6 and prior

Solution

Upgrade to Mozilla Firefox 1.0.7 or Mozilla Suite 1.7.12 :
http://www.mozilla.org/products/
Upgrade to Mozilla Thunderbird 1.0.7 :
http://www.mozilla.org/products/thunderbird/

References

http://www.vupen.com/english/advisories/2005/1824
http://www.mozilla.org/security/announce/mfsa2005-59.html
http://www.mozilla.org/security/announce/mfsa2005-58.html
http://www.mozilla.org/security/announce/mfsa2005-57.html

Credits

Vulnerabilities reported by jackerror, Mats Palmgren, moz_bug_r_a4, Georgi Guninski, heatsync and shutdown.

ChangeLog

2005-09-22 : Initial release
2005-10-01 : Updated Affected Products and Solution

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.