Firefox 2.0.0.12 Security Update fixes 7 Vulnerability & 3 critical patch (memory corruption, JavaScript Engine Crashes).

Known Vulnerabilities in Mozilla Products (Firefox 2.0.0.11)

MFSA 2008-11

Web forgery overwrite with div overlay

Descriptions

Security researchers Emil Ljungdahl and Lars-Olof Moilanen demonstrated that, in cases where the entire contents of a page are enclosed in a <div> with absolute positioning, a web forgery warning dialog won’t be displayed unless the user switches tabs away-from then back-to the forgery page.

References

• Web forgery warning not shown until tab switch
• National Vulnerability Database (NVD) - CVE-2008-0594

MFSA 2008-10

URL token stealing via stylesheet redirect

Descriptions

Security researcher Martin Straka reported that Gecko-based browsers update the .href property of stylesheet DOM nodes to reflect the final URI of the stylesheet after following any 302 redirects (much as the document.location property is updated). This differs from other browsers and could potentially reveal sensitive URL parameters, such as those used by Single-signon sytems, to scripts on the page.

References

• Stylesheet href property shows redirected URL unlike other browsers
• National Vulnerability Database (NVD) - CVE-2008-0593

MFSA 2008-09

Mishandling of locally-saved plain text files

Descriptions

Mozilla contributor oo.rio.oo demonstrated that once a file with Content-Disposition: attachment and (improper) Content-Type: plain/text is saved locally, the browser would no longer open local files with .txt extensions for viewing, but would rather prompt the user to save the file.

References

• plain text txt file viewing capability lost after having downloaded a txt file with content-disposition: attachment and content-type: plain/text
• National Vulnerability Database (NVD) - CVE-2008-0592

MFSA 2008-08

File action dialog tampering

Descriptions

Security researcher Michal Zalewski demonstrated that timer-enabled security dialogs can be subverted by attackers using JavaScript to change the window focus. Zalewski showed that a user could be tricked into confirming a security dialog of this type by bringing the dialog back into focus right before a user clicked in a predictable time and place.

References

• file action dialog controls vulnerable to refocus race
• National Vulnerability Database (NVD) - CVE-2008-0591

MFSA 2008-06

Web browsing history and forward navigation stealing

Descriptions

Mozilla contributor David Bloom reported a vulnerability in the way images are treated by the browser when a user leaves a page which utilizes designMode frames. The reported issue can be used to steal a user’s navigation history, forward navigation information, and crash the user’s browser. The crash showed evidence of memory corruption and might be exploitable to run arbitrary code.

References

• Vulnerability allows script to see where user is headed, sniff history, and crash [@ nsDocShell::Destroy()] the browser too
• National Vulnerability Database (NVD) - CVE-2008-0419

MFSA 2008-05

Directory traversal via chrome: URI

Descriptions

Gerry Eisenhaur reported the chrome: URI scheme improperly allowed directory traversal that could be used to load JavaScript, images, and stylesheets from local files in known locations. This traversal was possible only when the browser had installed add-ons which used “flat” packaging rather than the more popular .jar packaging, and the attacker would need to target that specific add-on.

Mozilla researcher moz_bug_r_a4 reported that this vulnerability could be used to steal the contents of the browser’s sessionstore.js file, which contains session cookie data and information about currently open web pages.

References

• Allows to steal data from sessionstore.js
• chrome directory traversal (local disk access via “flat” addons)
• list of “flat” packaged add-ons
• National Vulnerability Database (NVD) - CVE-2008-0418

MFSA 2008-04

Stored password corruption

Descriptions

Mozilla developer Justin Dolske discovered that malicious sites, upon a user saving his or her password, could inject newlines into Firefox’s password store and corrupt saved passwords for other sites.

References

• Content can corrupt stored passwords by injecting line breaks
• National Vulnerability Database (NVD) - CVE-2008-0417

MFSA 2008-03

Privilege escalation, XSS, Remote Code Execution

Descriptions

Mozilla contributors moz_bug_r_a4 and Boris Zbarsky submitted a series of vulnerabilities which allow scripts from page content to escape from its sandboxed context and/or run with chrome privileges. An additional vulnerability reported by moz_bug_r_a4 demonstrated that the XMLDocument.load() function can be used to inject script into another site, violating the browser’s same-origin policy.

References

• List of JavaScript privilege escalation bugs
• National Vulnerability Database (NVD) - CVE-2008-0415

MFSA 2008-02

Multiple file input focus stealing vulnerabilities

Descriptions

Security researchers hong and Gregory Fleisher each reported a variant on earlier reported bugs regarding focus shifting in file input controls. Their variants used file input controls nested inside <label> tags to take advantage of automatic focus shifting into the file input field noted on the Hacker WebZine. As with the earlier reported issues this issue could be used to force a user to upload arbitrary files assuming the attacker knows the full path and name of the file.

These bugs are variations on earlier problems reported by Charles McAuley and Michal Zalewski which were fixed in Firefox 2.0.0.4, as well as an issue reported by hong which was fixed in Firefox 2.0.0.8.
Gregory Fleisher also submitted a series of demonstrations of different ways to lure a user to place focus into the file input control manually. These demonstrations included “focus spoofing” by selectively capturing keystrokes and placing the captured characters where the user thinks the focus should be.

References

• List of Focus shifting bugs
• National Vulnerability Database (NVD) - CVE-2008-0414

MFSA 2008-01

Crashes with evidence of memory corruption (rv:1.8.1.12)

Descriptions

Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox 2.0.0.12 and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. Without further investigation we cannot rule out the possibility that for some of these an attacker might be able to prepare memory for exploitation through some means other than JavaScript such as large images.

References

• List of JavaScript Engine Crashes
• National Vulnerability Database (NVD) - CVE-2008-0413
• List of Browser Crashes Bugs
• National Vulnerability Database (NVD) - CVE-2008-0412

Thunderbird Security Release

Thunderbird 2.0.0.12 is schedule to be release on February 28.

External Links

• Download Firefox 2.0.0.12