Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability
BID:11192
Info
Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability
| Bugtraq ID: | 11192 |
| Class: | Design Error |
| CVE: |
CVE-2004-0907 CVE-2004-0906 |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 15 2004 12:00AM |
| Updated: | Aug 05 2010 07:45PM |
| Credit: | Discovery of this vulnerability is credited to Harald Milz <[email protected]>. |
| Vulnerable: |
Mozilla Thunderbird 0.7.3 Mozilla Thunderbird 0.7.2 Mozilla Thunderbird 0.7.1 Mozilla Thunderbird 0.7 Mozilla Thunderbird 0.6 Mozilla Firefox 0.9.3 Mozilla Firefox 0.9.2 Mozilla Firefox 0.9.1 Mozilla Firefox 0.9 rc Mozilla Firefox 0.9 Mozilla Browser 1.7.2 Mozilla Browser 1.7.1 Mozilla Browser 1.7 rc3 Mozilla Browser 1.7 rc2 Mozilla Browser 1.7 rc1 Mozilla Browser 1.7 beta Mozilla Browser 1.7 alpha Mozilla Browser 1.7 Mozilla Browser 1.6 Mozilla Browser 1.5.1 Mozilla Browser 1.5 Mozilla Browser 1.4.4 Mozilla Browser 1.4.2 Mozilla Browser 1.4.1 Mozilla Browser 1.4 b Mozilla Browser 1.4 a Mozilla Browser 1.4 Mozilla Browser 1.3.1 Mozilla Browser 1.3 Mozilla Browser 1.2.1 Mozilla Browser 1.2 Beta Mozilla Browser 1.2 Alpha Mozilla Browser 1.2 Mozilla Browser 1.1 Beta Mozilla Browser 1.1 Alpha Mozilla Browser 1.1 Mozilla Browser 1.0.2 Mozilla Browser 1.0.1 Mozilla Browser 1.0 Mozilla Browser 0.9.48 Mozilla Browser 0.9.35 Mozilla Browser 0.9.9 Mozilla Browser 0.9.8 Mozilla Browser 0.9.7 Mozilla Browser 0.9.6 Mozilla Browser 0.9.5 Mozilla Browser 0.9.4 .1 Mozilla Browser 0.9.4 Mozilla Browser 0.9.3 Mozilla Browser 0.9.2 .1 Mozilla Browser 0.9.2 Mozilla Browser 0.8 |
| Not Vulnerable: |
Mozilla Firefox Preview Release Mozilla Browser 1.7.3 |
Discussion
Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability
Mozilla and Mozilla Firefox browsers tar.gz archive that contains the installation files is reported susceptible to an improper file permissions vulnerability. It is reported that if the archive is extracted in a certain manner, then the archive is extracted with world read/writeable permissions on its contents.
This allows attackers with local interactive access to overwrite or modify installation files used during the installation of the browser.
Mozilla and Mozilla Firefox browsers tar.gz archive that contains the installation files is reported susceptible to an improper file permissions vulnerability. It is reported that if the archive is extracted in a certain manner, then the archive is extracted with world read/writeable permissions on its contents.
This allows attackers with local interactive access to overwrite or modify installation files used during the installation of the browser.
Exploit / POC
Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability
Solution:
This issue is addressed in Mozilla 1.7.3 and Firefox Preview Release:
Mozilla Browser 0.8
Mozilla Firefox 0.9
Mozilla Firefox 0.9 rc
Mozilla Firefox 0.9.1
Mozilla Browser 0.9.2 .1
Mozilla Firefox 0.9.2
Mozilla Browser 0.9.2
Mozilla Firefox 0.9.3
Mozilla Browser 0.9.3
Mozilla Browser 0.9.35
Mozilla Browser 0.9.4
Mozilla Browser 0.9.4 .1
Mozilla Browser 0.9.48
Mozilla Browser 0.9.5
Mozilla Browser 0.9.6
Mozilla Browser 0.9.7
Mozilla Browser 0.9.8
Mozilla Browser 0.9.9
Mozilla Browser 1.0
Mozilla Browser 1.0.1
Mozilla Browser 1.0.2
Mozilla Browser 1.1
Mozilla Browser 1.1 Alpha
Mozilla Browser 1.1 Beta
Mozilla Browser 1.2 Alpha
Mozilla Browser 1.2
Mozilla Browser 1.2 Beta
Mozilla Browser 1.2.1
Mozilla Browser 1.3
Mozilla Browser 1.3.1
Mozilla Browser 1.4 b
Mozilla Browser 1.4
Mozilla Browser 1.4 a
Mozilla Browser 1.4.1
Mozilla Browser 1.4.2
Mozilla Browser 1.5
Mozilla Browser 1.6
Mozilla Browser 1.7
Mozilla Browser 1.7 rc3
Mozilla Browser 1.7.1
Mozilla Browser 1.7.2
Solution:
This issue is addressed in Mozilla 1.7.3 and Firefox Preview Release:
Mozilla Browser 0.8
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Firefox 0.9
-
Mozilla Firefox Preview Release
http://www.mozilla.org/products/firefox/releases/0.10.html
Mozilla Firefox 0.9 rc
-
Mozilla Firefox Preview Release
http://www.mozilla.org/products/firefox/releases/0.10.html
Mozilla Firefox 0.9.1
-
Mozilla Firefox Preview Release
http://www.mozilla.org/products/firefox/releases/0.10.html
Mozilla Browser 0.9.2 .1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Firefox 0.9.2
-
Mozilla Firefox Preview Release
http://www.mozilla.org/products/firefox/releases/0.10.html
Mozilla Browser 0.9.2
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Firefox 0.9.3
-
Mozilla Firefox Preview Release
http://www.mozilla.org/products/firefox/releases/0.10.html
Mozilla Browser 0.9.3
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.35
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.4
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.4 .1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.48
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.5
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.6
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.7
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.8
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 0.9.9
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.0
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.0.1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.0.2
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.1 Alpha
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.1 Beta
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.2 Alpha
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.2
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.2 Beta
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.2.1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.3
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.3.1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.4 b
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.4
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.4 a
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.4.1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.4.2
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.5
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.6
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.7
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.7 rc3
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.7.1
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
Mozilla Browser 1.7.2
-
Mozilla Mozilla 1.7.3
http://www.mozilla.org/releases/
References
Mozilla/Firefox Browsers Tar.GZ Archive Weak Permissions Vulnerability
References:
References: