Firefox Wrapped 'javascript:' URLs Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013963
|
|
SecurityTracker URL: http://securitytracker.com/id?1013963
|
|
CVE Reference: CAN-2005-1531
(Links to External Site)
|
Updated: May 23 2005
|
Original Entry Date: May 12 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Mozilla Foundation Security Advisory
|
Version(s): prior to 1.0.4
|
Description: A vulnerability was reported in the Firefox web browser in the processing of 'javascript:' URLs. A remote user can bypass certain security checks.
A remote user can create a specially crafted 'view-source:' protocol URL or 'jar:' protocol URL that includes a 'javascript:' URL
that, when loaded by the target user, will execute scripting code with privileges. Arbitrary code can be executed.
No further
details were provided.
The vendor credits Michael Krax, Georgi Guninski, and L. David Baron with reporting this vulnerability.
|
Impact: A remote user can cause arbitrary code to be executed on the target user's computer.
|
Solution: The vendor has issued a fixed version (1.0.4), available at:
http://www.mozilla.org/products/firefox/
|
Vendor URL: www.mozilla.org/security/announce/mfsa2005-43.html (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 12 May 2005 10:56:07 -0400
Subject: http://www.mozilla.org/security/announce/mfsa2005-43.html
|
> Title: "Wrapped" javascript: urls bypass security checks
> Severity: Critical
> Reporter: Michael Krax, Georgi Guninski, L. David Baron
> Products: Firefox, Mozilla Suite
> Fixed in: Firefox 1.0.4
> Mozilla Suite 1.7.8
> Some security checks intended to prevent script injection were incorrect and could
> be bypassed by wrapping a javascript: url in the view-source: pseudo-protocol.
> Michael Krax demonstrated that a variant of his favicon exploit could still execute
> arbitrary code, and the same technique could also be used to perform cross-site
> scripting.
>
> Georgi Guninski demonstrated the same flaw wrapping javascript: urls with the jar:
> pseudo-protocol.
>
> L. David Baron discovered a nested variant that defeated checks in the script
> security manager.
|
|
