OSVDB ID: 32111

Title: Mozilla Multiple Products HTML Tag Attribute Trailing Character Content Filter Bypass

Info

Disclosure
Feb 23, 2007

Discovery
Oct 27, 2005

Dates

Exploit
Unknown

Solution
Unknown

Description

 Mozilla Firefox and SeaMonkey parsers improperly ignore invalid trailing characters in HTML tag attribute names. This allows remote attackers to bypass web site content filters that use regular expressions and execute arbitrary scripting code resulting in a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to Mozilla Firefox version 2.0.0.2 or higher, Mozilla Firefox version 1.5.0.10 or higher, and Mozilla SeaMonkey version 1.0.8 or higher as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Mozilla Organization

SeaMonkey

 1.0.8
1.0.7
1.0.6
1.0.5
1.0.3
1.0.2
1.0.1
1.0 dev
1.0

Firefox

 2.0.0.2
1.5.0.10
0.8
0.9
0.9 rc
0.9.1
0.9.2
0.9.3
0.10
0.10.1
1.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.5
1.5 beta 1
1.5 beta 2
1.5.0.1
1.5.0.2
1.5.0.3
1.5.0.4
1.5.0.5
1.5.0.6
1.5.0.7
1.5.0.9
2.0
2.0 Beta 1
2.0 RC2
2.0 RC3
2.0.1

References

Credit
  • Alejandro Torras - atec_postyahoo.es -


Direct URL: http://osvdb.org/32111