Multiple Browser Proxy Auto-Config Script Handling Remote Denial of Service Vulnerability

Bugtraq ID:	14924
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-3089
Remote:	Yes
Local:	No
Published:	Sep 23 2005 12:00AM
Updated:	Aug 01 2006 10:06PM
Credit:	Discovery is credited to William B. Ackerman <[email protected]>.
Vulnerable:	Redhat Linux 9.0 i386 Redhat Linux 7.3 i686 Redhat Linux 7.3 i386 Redhat Linux 7.3 Redhat Fedora Core2 Redhat Fedora Core1 Netscape Browser 8.0.3 .3 Mozilla Firefox 1.0.6 Mozilla Firefox 1.0.5 Mozilla Firefox 1.0.5 Mozilla Firefox 1.0.4 Mozilla Firefox 1.0.3 + Gentoo Linux Mozilla Firefox 1.0.2 + Mandriva Linux Mandrake 10.2 x86_64 + Mandriva Linux Mandrake 10.2 + Mandriva Linux Mandrake 10.2 + Redhat Desktop 4.0 + Redhat Desktop 4.0 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux WS 4 + Redhat Enterprise Linux WS 4 Mozilla Firefox 1.0.1 + Redhat Fedora Core3 Mozilla Firefox 1.0 + Gentoo Linux + Gentoo Linux + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 9.0 + Slackware Linux 10.1 + Slackware Linux 10.0 + Slackware Linux 10.0 + Slackware Linux 9.1 + Slackware Linux 9.1 + Slackware Linux -current + Slackware Linux -current Mozilla Browser 1.7.11 Mozilla Browser 1.7.9 Mozilla Browser 1.7.8 Mozilla Browser 1.7.7 + Redhat Desktop 4.0 + Redhat Desktop 4.0 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux WS 4 + Redhat Enterprise Linux WS 4 + Turbolinux Home + Turbolinux Home + Turbolinux Turbolinux 10 F... + Turbolinux Turbolinux 10 F... + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 10.0 Mozilla Browser 1.7.6 + HP HP-UX B.11.23 + HP HP-UX B.11.23 + HP HP-UX B.11.22 + HP HP-UX B.11.22 + HP HP-UX B.11.11 + HP HP-UX B.11.11 + HP HP-UX B.11.11 + HP HP-UX B.11.11 + HP HP-UX B.11.00 + HP HP-UX B.11.00 + Redhat Desktop 4.0 + Redhat Desktop 4.0 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux AS 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux ES 4 + Redhat Enterprise Linux WS 4 + Redhat Enterprise Linux WS 4 + Turbolinux Home + Turbolinux Home + Turbolinux Turbolinux 10 F... + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 Mozilla Browser 1.7.5 + HP Tru64 5.1 B-2 PK4 (BL25) + HP Tru64 5.1 B-2 PK4 + HP Tru64 5.1 B-2 PK4 + HP Tru64 5.1 B PK4 + HP Tru64 5.1 B PK4 + HP Tru64 5.1 A PK6 (BL24) + HP Tru64 5.1 A PK6 (BL24) + HP Tru64 5.1 A PK6 + HP Tru64 5.1 A PK6 Mozilla Browser 1.7.4 Mozilla Browser 1.7.3 + HP HP-UX B.11.23 + HP HP-UX B.11.22 + HP HP-UX B.11.22 + HP HP-UX B.11.11 + HP HP-UX B.11.11 + HP HP-UX B.11.11 + HP HP-UX B.11.11 + HP HP-UX B.11.00 + HP HP-UX B.11.00 + HP Tru64 5.1 B-2 PK4 (BL25) + HP Tru64 5.1 B-2 PK4 (BL25) + HP Tru64 5.1 B-2 PK4 + HP Tru64 5.1 B-2 PK4 + HP Tru64 5.1 B PK4 + HP Tru64 5.1 B PK4 + HP Tru64 5.1 A PK6 (BL24) + HP Tru64 5.1 A PK6 (BL24) + HP Tru64 5.1 A PK6 + HP Tru64 5.1 A PK6 Mozilla Browser 1.7.2 Mozilla Browser 1.7.1 Mozilla Browser 1.7 rc3 Mozilla Browser 1.7 rc2 Mozilla Browser 1.7 rc1 Mozilla Browser 1.7 beta Mozilla Browser 1.7 alpha Mozilla Browser 1.7
Not Vulnerable:	Mozilla Firefox 1.0.7 Mozilla Browser 1.7.12

Multiple Browser Proxy Auto-Config Script Handling Remote Denial of Service Vulnerability

Multiple browsers are affected by a remote denial-of-service vulnerability when handling proxy auto-config scripts. This can cause a crash in an instance of an affected browser.

Firefox 1.0.6 and prior versions, Netscape Browser 8.0.3.3, and Mozilla 1.7.11 and prior versions are affected by this issue.

Multiple Browser Proxy Auto-Config Script Handling Remote Denial of Service Vulnerability

An exploit is not required.

Multiple Browser Proxy Auto-Config Script Handling Remote Denial of Service Vulnerability

Solution:
Mozilla 1.7.12 is available to address this issue.

Firefox 1.0.7 is available to address this issue.

Fedora Legacy has released security advisory FLSA:168375 to address this and other issues. Please see the referenced advisory for more information.


Mozilla Firefox 1.0

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.1

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.2

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.3

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.4

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.5

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.5

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Firefox 1.0.6

• Mozilla Firefox 1.0.7
  http://www.mozilla.org/products/firefox/

Mozilla Browser 1.7 beta

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7 rc1

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7 rc3

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7 rc2

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7 alpha

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.1

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.11

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.2

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.3

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.4

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.5

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.6

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.7

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Mozilla Browser 1.7.8

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/


• RedHat Fedora epiphany-1.4.9-1.i386.rpm
  Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• RedHat Fedora epiphany-1.4.9-1.x86_64.rpm
  Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• RedHat Fedora epiphany-debuginfo-1.4.9-1.i386.rpm
  Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• RedHat Fedora epiphany-debuginfo-1.4.9-1.x86_64.rpm
  Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• RedHat Fedora epiphany-devel-1.4.9-1.i386.rpm
  Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• RedHat Fedora epiphany-devel-1.4.9-1.x86_64.rpm
  Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

Mozilla Browser 1.7.9

• Mozilla Mozilla 1.7.12
  http://www.mozilla.org/products/mozilla1.x/

Multiple Browser Proxy Auto-Config Script Handling Remote Denial of Service Vulnerability

References:

• Firefox 1.0.6 crashes when loading any page if PAC script uses eval (William B. Ackerman )
  
• Firefox 1.0.7 Release Notes (Mozilla)
  
• Mozilla 1.7.12 (Mozilla)
  
• Mozilla Firefox Home Page (Mozilla)
  
• Mozilla Homepage (Mozilla Foundation)