Mozilla Firefox About Configuration Hidden Frame Remote Configuration Manipulation Vulnerability
BID:12466
Info
Mozilla Firefox About Configuration Hidden Frame Remote Configuration Manipulation Vulnerability
| Bugtraq ID: | 12466 |
| Class: | Access Validation Error |
| CVE: |
CVE-2005-0232 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 07 2005 12:00AM |
| Updated: | Jul 12 2009 10:06AM |
| Credit: | "mikx" <[email protected]> is credited with the disclosure of this issue. This issue affecting Netscape was reported by Juha-Matti Laurio. |
| Vulnerable: |
SGI ProPack 3.0 Redhat Linux 9.0 i386 Redhat Linux 7.3 i686 Redhat Linux 7.3 i386 Redhat Linux 7.3 Redhat Fedora Core2 Redhat Fedora Core1 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Desktop 3.0 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 Netscape Netscape 7.2 Mozilla Firefox 1.0 Mozilla Firefox 0.10.1 Mozilla Firefox 0.10 Mozilla Firefox 0.9.3 Mozilla Firefox 0.9.2 Mozilla Firefox 0.9.1 Mozilla Firefox 0.9 rc Mozilla Firefox 0.9 Mozilla Firefox 0.8 Mozilla Browser 1.7.5 Mozilla Browser 1.4.4 Gentoo Linux |
| Not Vulnerable: |
Mozilla Firefox 1.0.1 |
Discussion
Mozilla Firefox About Configuration Hidden Frame Remote Configuration Manipulation Vulnerability
A remote configuration manipulation vulnerability affects Mozilla Firefox. This issue is due to a failure of the application to properly secure sensitive configuration scripts from being activated by remote attackers.
An attacker may leverage this issue to alter an unsuspecting user's configuration settings; this may lead to a false sense of security as sensitive settings may be manipulated without the user's knowledge.
A remote configuration manipulation vulnerability affects Mozilla Firefox. This issue is due to a failure of the application to properly secure sensitive configuration scripts from being activated by remote attackers.
An attacker may leverage this issue to alter an unsuspecting user's configuration settings; this may lead to a false sense of security as sensitive settings may be manipulated without the user's knowledge.
Exploit / POC
Mozilla Firefox About Configuration Hidden Frame Remote Configuration Manipulation Vulnerability
A proof of concept exploit has been created to outline the exploitation of this issue. It should be noted that Symantec has not verified this proof of concept in any way and users are advised to be extremely cautious when using it for testing.
http://www.mikx.de/fireflashing/
A proof of concept exploit has been created to outline the exploitation of this issue. It should be noted that Symantec has not verified this proof of concept in any way and users are advised to be extremely cautious when using it for testing.
http://www.mikx.de/fireflashing/
Solution / Fix
Mozilla Firefox About Configuration Hidden Frame Remote Configuration Manipulation Vulnerability
Solution:
Mozilla has released version 1.0.1 of Firefox to address this, and other issues.
SGI has released an advisory 20050501-01-U including updated SGI ProPack 3 Service Pack 5 packages to address this BID and other issues. Please see the referenced advisory for more information.
Red Hat has released advisory RHSA-2005:384-11 and fixes to address this and other issues on Red Hat Linux Enterprise platforms. Customers who are affected are advised to apply the appropriate updates. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
SGI has released an advisory 20050304-01-U including updated SGI ProPack 3 Service Pack 4 packages to address this issue. Please see the referenced advisory for more information.
RedHat Fedora Linux has made an advisory available dealing with this issue in their Core 3 distribution. Please see the reference section for more information.
Gentoo has released an advisory (GLSA 200503-10) and updated eBuilds to address this vulnerability. Gentoo users that are running the affected software may apply the update by issuing the following sequence of commands as a superuser:
For Firefox users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-1.0.1"
For Firefox binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-bin-1.0.1"
SuSE Linux has released advisory SUSE-SA:2005:016 along with fixes dealing with this issue. Please see the referenced advisory for more information.
Gentoo has released advisory GLSA 200503-30 to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:
Mozilla Suite users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.6"
Mozilla Suite binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.6"
RedHat has released advisory RHSA-2005:323 to address this issue. Please see the referenced advisory to obtain fix information.
RedHat Fedora Legacy has released advisory FLSA:152883 addressing this and other issues for RedHat Linux 7.3, 9 and for Fedora Core 1 and Core 2. Please see the referenced advisory for details on obtaining and applying the appropriate updates.
Mozilla Firefox 0.10
Mozilla Firefox 0.10.1
Mozilla Firefox 0.8
Mozilla Firefox 0.9
Mozilla Firefox 0.9 rc
Mozilla Firefox 0.9.1
Mozilla Firefox 0.9.2
Mozilla Firefox 0.9.3
Mozilla Firefox 1.0
Solution:
Mozilla has released version 1.0.1 of Firefox to address this, and other issues.
SGI has released an advisory 20050501-01-U including updated SGI ProPack 3 Service Pack 5 packages to address this BID and other issues. Please see the referenced advisory for more information.
Red Hat has released advisory RHSA-2005:384-11 and fixes to address this and other issues on Red Hat Linux Enterprise platforms. Customers who are affected are advised to apply the appropriate updates. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
SGI has released an advisory 20050304-01-U including updated SGI ProPack 3 Service Pack 4 packages to address this issue. Please see the referenced advisory for more information.
RedHat Fedora Linux has made an advisory available dealing with this issue in their Core 3 distribution. Please see the reference section for more information.
Gentoo has released an advisory (GLSA 200503-10) and updated eBuilds to address this vulnerability. Gentoo users that are running the affected software may apply the update by issuing the following sequence of commands as a superuser:
For Firefox users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-1.0.1"
For Firefox binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-bin-1.0.1"
SuSE Linux has released advisory SUSE-SA:2005:016 along with fixes dealing with this issue. Please see the referenced advisory for more information.
Gentoo has released advisory GLSA 200503-30 to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:
Mozilla Suite users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.6"
Mozilla Suite binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.6"
RedHat has released advisory RHSA-2005:323 to address this issue. Please see the referenced advisory to obtain fix information.
RedHat Fedora Legacy has released advisory FLSA:152883 addressing this and other issues for RedHat Linux 7.3, 9 and for Fedora Core 1 and Core 2. Please see the referenced advisory for details on obtaining and applying the appropriate updates.
Mozilla Firefox 0.10
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.10.1
-
Fedora firefox-1.0.1-1.3.1.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora firefox-1.0.1-1.3.1.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora firefox-debuginfo-1.0.1-1.3.1.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora firefox-debuginfo-1.0.1-1.3.1.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.8
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.9
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.9 rc
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.9.1
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.9.2
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 0.9.3
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2
Mozilla Firefox 1.0
-
Mozilla firefox-1.0.1-source.tar.bz2
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.1/source/f irefox-1.0.1-source.tar.bz2 -
SuSE MozillaFirebird-1.0.1-2.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/MozillaFirebird-1 .0.1-2.i586.rpm -
SuSE MozillaFirebird-1.0.1-2.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/MozillaFirebi rd-1.0.1-2.x86_64.rpm -
SuSE MozillaFirefox-1.0.1-9.1.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/MozillaFirefox-1. 0.1-9.1.i586.rpm -
SuSE MozillaFirefox-1.0.1-9.1.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/MozillaFirefox-1. 0.1-9.1.i586.rpm -
SuSE MozillaFirefox-1.0.1-9.1.x86_64.rpm
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/MozillaFirefox- 1.0.1-9.1.x86_64.rpm -
SuSE MozillaFirefox-1.0.1-9.1.x86_64.rpm
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/MozillaFirefo x-1.0.1-9.1.x86_64.rpm
References
Mozilla Firefox About Configuration Hidden Frame Remote Configuration Manipulation Vulnerability
References:
References:
- Firefox Release Notes (Mozilla)
- RHSA-2005:323-10 Critical: mozilla security update (RedHat)
- RHSA-2005:384-11 - Mozilla security update (Red Hat)
- Fireflashing [Firefox 1.0] ("mikx"