Multiple Browser IMG Tag Multiple Vulnerabilities
BID:11648
Info
Multiple Browser IMG Tag Multiple Vulnerabilities
| Bugtraq ID: | 11648 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 10 2004 12:00AM |
| Updated: | Nov 10 2004 12:00AM |
| Credit: | Discovery is credited to Wolfgang Schwarz <[email protected]>. |
| Vulnerable: |
Netscape Netscape 7.0 Netscape Navigator 7.2 Netscape Navigator 7.1 Netscape Navigator 7.0.2 Netscape Navigator 7.0 Mozilla Firefox 0.10.1 Mozilla Firefox 0.10 Mozilla Firefox 0.9.3 Mozilla Firefox 0.9.2 Mozilla Firefox 0.9.1 Mozilla Firefox 0.9 rc Mozilla Firefox 0.9 Mozilla Firefox 0.8 Microsoft Internet Explorer 6.0 SP2 - do not use Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 |
| Not Vulnerable: |
Mozilla Firefox 1.0 |
Discussion
Multiple Browser IMG Tag Multiple Vulnerabilities
Various browsers are reported prone to multiple vulnerabilities in the image handling functionality through the <IMG> tag. These issues can allow remote attackers to determine the existence of local files, cause a denial of service condition, and disclose passwords for Windows systems via file shares.
Mozilla Firefox 0.10.1 and prior versions are reported vulnerable to these issues. It is alleged that Microsoft Internet Explorer and Netscape Browsers are also vulnerable to these issues. Due to this vulnerable packages for Internet Explorer and Netscape have been added. This BID will be updated as more information becomes available.
Various browsers are reported prone to multiple vulnerabilities in the image handling functionality through the <IMG> tag. These issues can allow remote attackers to determine the existence of local files, cause a denial of service condition, and disclose passwords for Windows systems via file shares.
Mozilla Firefox 0.10.1 and prior versions are reported vulnerable to these issues. It is alleged that Microsoft Internet Explorer and Netscape Browsers are also vulnerable to these issues. Due to this vulnerable packages for Internet Explorer and Netscape have been added. This BID will be updated as more information becomes available.
Exploit / POC
Multiple Browser IMG Tag Multiple Vulnerabilities
The following proof of concept is available:
<img src="file:///c|/nonexistent/content.gif">
<img src="file:///c|/windows/content.gif">
<script>
onload =function(){
incl=(document.images[0].width!=document.images[1].width)? "" :"not ";
alert("Windows is "+ incl +"installed in C:/WINDOWS/");
}
</script>
The following proof of concept is available:
<img src="file:///c|/nonexistent/content.gif">
<img src="file:///c|/windows/content.gif">
<script>
onload =function(){
incl=(document.images[0].width!=document.images[1].width)? "" :"not ";
alert("Windows is "+ incl +"installed in C:/WINDOWS/");
}
</script>
Solution / Fix
Multiple Browser IMG Tag Multiple Vulnerabilities
Solution:
The vendor has released an upgrade dealing with this issue.
Gentoo has released an advisory GLSA 200501-03 to address various issues in multiple browsers offered by Mozilla. Gentoo users may carry out the following commands to update their computers:
Mozilla users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-1.7.5"
Mozilla binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-bin-1.7.5"
Firefox users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-1.0"
Firefox binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-bin-1.0"
Thunderbird users:
# emerge --sync
# emerge --ask --oneshot ?verbose ">=mail-client/mozilla-thunderbird-0.9"
Thunderbird:
# emerge --sync
# emerge --ask --oneshot ?verbose ">=mail-client/mozilla-thunderbird-bin-0.9"
Please see the referenced advisory for more information.
Mozilla Firefox 0.10
Mozilla Firefox 0.10.1
Mozilla Firefox 0.8
Mozilla Firefox 0.9
Mozilla Firefox 0.9.1
Mozilla Firefox 0.9.2
Mozilla Firefox 0.9.3
Solution:
The vendor has released an upgrade dealing with this issue.
Gentoo has released an advisory GLSA 200501-03 to address various issues in multiple browsers offered by Mozilla. Gentoo users may carry out the following commands to update their computers:
Mozilla users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-1.7.5"
Mozilla binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-bin-1.7.5"
Firefox users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-1.0"
Firefox binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-bin-1.0"
Thunderbird users:
# emerge --sync
# emerge --ask --oneshot ?verbose ">=mail-client/mozilla-thunderbird-0.9"
Thunderbird:
# emerge --sync
# emerge --ask --oneshot ?verbose ">=mail-client/mozilla-thunderbird-bin-0.9"
Please see the referenced advisory for more information.
Mozilla Firefox 0.10
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
Mozilla Firefox 0.10.1
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
Mozilla Firefox 0.8
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
Mozilla Firefox 0.9
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
Mozilla Firefox 0.9.1
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
Mozilla Firefox 0.9.2
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
Mozilla Firefox 0.9.3
-
Mozilla Firefox 1.0
http://www.mozilla.org/products/firefox/
References
Multiple Browser IMG Tag Multiple Vulnerabilities
References:
References:
- Bugzilla Bug 69070 (Wolfgang Schwarz
- Mozilla Homepage (Mozilla Foundation)