SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Web Browser)  >   Mozilla Firefox Vendors:   Mozilla.org
Firefox Search Plug-in Lets Remote Users Execute Scripting Code in Active Tabs
SecurityTracker Alert ID:  1013745
SecurityTracker URL:  http://securitytracker.com/id/1013745
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Updated:  Apr 16 2005
Original Entry Date:  Apr 16 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 1.0.3
Description:   A vulnerability was reported in Firefox in the search plugin implementation. A remote user can execute arbitrary scripting code, potentially with elevated privileges.

A remote user can create a specially crafted sherlock file that will run arbitrary javascript in the context of the currently active tab. The code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A search engine can exploit this to access website content in the currently active tab and, when a privileged page is loaded, run arbitrary code on the target user's system.

A remote user can also overwrite an existing search engine.

The vendor credits Michael Krax with reporting this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with a site in the currently active tab, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has issued a fixed version (1.0.3), available at:

http://www.mozilla.org/

Vendor URL:  www.mozilla.org/security/announce/mfsa2005-38.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC