27559 : Mozilla Multiple Products Window Navigator Object Arbitrary Code Execution
Printer | http://osvdb.org/27559 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
12	2243	over 5 years ago	about 1 year ago	7 times	100%

Timeline

Vendor Informed Date	Disclosure Date	Vendor Solution Date
2006-06-16	2006-07-25	2006-07-25

Time to Patch
39 days

Keywords

MoBB #28 c00771742, HPSBUX02153, SSRT061181

Description

A code execution flaw exists in multiple Mozilla browsers. Firefox and SeaMonkey fail to validate values assigned to window.navigator objects. With a specially crafted website, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Local / Remote, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public, Exploit Private, Exploit Commercial
Disclosure: Vendor Verified, Vendor Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

Upgrade Firefox to version 1.5.0.5 or Seamonkey to version 1.0.3, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Mozilla Organization	Firefox	1.5.0.4
Mozilla Organization	SeaMonkey	1.0.2

References

Security Tracker: 1016586 1016587
Bugtraq ID: 19181 19192
Secunia Advisory ID: 19873 21216 21228 21229 21243 21246 21262 21269 21270 21336 21343 21361 21529 21532 21631 22065 22066 22210
CVE ID: 2006-3677 (see also: NVD)
SCIP VulDB ID: 2397
Related OSVDB ID: 27558 27560 27561 27562 27564 27565 27566 27567 27568 27569 27572
Metasploit ID: 27559
CERT VU: 670060
VUPEN Advisory: ADV-2006-2998
Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc http://lists.suse.com/archive/suse-security-announce/2006-Aug/0007.html
http://www.gentoo.org/security/en/glsa/glsa-200608-02.xml
http://www.gentoo.org/security/en/glsa/glsa-200608-03.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2006:143
http://www.mozilla.org/security/announce/2006/mfsa2006-45.html
http://www.ubuntu.com/usn/usn-327-1
http://www.ubuntu.com/usn/usn-354-1
https://issues.rpath.com/browse/RPL-536
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0492.html
http://archives.neohapsis.com/archives/bugtraq/2008-01/0085.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0696.html
http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0682.html
Other Advisory URL: http://browserfun.blogspot.com/2006/07/mobb-28-mozilla-navigator-object.html
http://www.zerodayinitiative.com/advisories/ZDI-06-025.html
Generic Exploit URL: http://metasploit.com/users/hdm/tools/browserfun/mobb_028.html
http://www.saintcorporation.com/cgi-bin/exploit_info/firefox_navigator
http://www.securiteam.com/exploits/5LP090KJFW.html
News Article: http://news.com.com/Firefox+update+plugs+critical+holes/2100-1002_3-6099254.html
Vendor Specific News/Changelog Entry: http://www.caminobrowser.org/releases/1.0.2.php
Keyword: MoBB #28
RedHat RHSA: RHSA-2006:0594 RHSA-2006:0608 RHSA-2006:0609 RHSA-2006:0610 RHSA-2006:0611

Tools & Filters

	22095 22096 22097 22114 22121 22122 22144 22145 22150 22291 22701 22702 22703 23892 27113 27435 27905 29354
	3694 3695
Snort	8058

Credit

Anonymous - Zero Day Initiative (ZDI)

CVSSv2 Score

CVSSv2 Base Score = 7.5
Source: nvd.nist.gov | Generated: 2006-07-31 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.