Mozilla / Netscape 6 XMLHttpRequest File Disclosure Vulnerability
BID:4628
Info
Mozilla / Netscape 6 XMLHttpRequest File Disclosure Vulnerability
| Bugtraq ID: | 4628 |
| Class: | Design Error |
| CVE: |
CVE-2002-0354 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 30 2002 12:00AM |
| Updated: | Jul 11 2009 12:46PM |
| Credit: | Discovered by GreyMagic Software <[email protected]>. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Netscape Netscape 6.2.2 Netscape Netscape 6.2.1 Netscape Netscape 6.2 Netscape Netscape 6.1 Mozilla Browser 1.0 RC1 Mozilla Browser 0.9.9 Mozilla Browser 0.9.8 Mozilla Browser 0.9.7 IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 4.3 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.24 HP HP-UX 10.20 HP HP-UX 10.10 Galeon Browser 1.2.1 Galeon Browser 1.2 Eazel Nautilus 1.0.4 Compaq Tru64 5.1 a Compaq Tru64 5.1 Compaq Tru64 5.0 a Compaq Tru64 4.0 g Compaq Tru64 4.0 f |
| Not Vulnerable: |
Mozilla Browser 1.0 RC2 |
Discussion
Mozilla / Netscape 6 XMLHttpRequest File Disclosure Vulnerability
An issue exists in handling of HTTP redirects in the XMLHttpRequest object used by Mozilla and Netscape 6.
The XMLHttpRequest object allows a client machine to obtain an XML document through a HTTP request. If the server response to this request is a redirect to a local file, script security measures are bypassed and the file is accessed. This could lead to a disclosure of sensitive information to remote attackers.
This vulnerability may also be used to list files in folders, potentially allowing all files that the user of the browser has access to being listed.
It has been reported that this issue also exists with the load method applied to XML documents created with the createDocument method of the DOMImplementation interface.
Some updates have been released for both Nautilus and Galeon, which have source common to the Mozilla project. The vulnerability of these products has not, however, been independantly confirmed.
An issue exists in handling of HTTP redirects in the XMLHttpRequest object used by Mozilla and Netscape 6.
The XMLHttpRequest object allows a client machine to obtain an XML document through a HTTP request. If the server response to this request is a redirect to a local file, script security measures are bypassed and the file is accessed. This could lead to a disclosure of sensitive information to remote attackers.
This vulnerability may also be used to list files in folders, potentially allowing all files that the user of the browser has access to being listed.
It has been reported that this issue also exists with the load method applied to XML documents created with the createDocument method of the DOMImplementation interface.
Some updates have been released for both Nautilus and Galeon, which have source common to the Mozilla project. The vulnerability of these products has not, however, been independantly confirmed.
Exploit / POC
Mozilla / Netscape 6 XMLHttpRequest File Disclosure Vulnerability
The following exploit is provided by GreyMagic Software <[email protected]>:
http://sec.greymagic.com/adv/gm001-ns/
An exploit for the document.load method has been provided by Thor Larholm <[email protected]>:
http://jscript.dk/2002/4/NS6Tests/documentload.html
The following exploit is provided by GreyMagic Software <[email protected]>:
http://sec.greymagic.com/adv/gm001-ns/
An exploit for the document.load method has been provided by Thor Larholm <[email protected]>:
http://jscript.dk/2002/4/NS6Tests/documentload.html
Solution / Fix
Mozilla / Netscape 6 XMLHttpRequest File Disclosure Vulnerability
Solution:
This issue has been resolved in Mozilla 1.0RC1 builds dated later than May 02, 2002.
Vendor updates are also available:
Mozilla Browser 0.9.7
Mozilla Browser 0.9.8
Mozilla Browser 0.9.9
Mozilla Browser 1.0 RC1
Eazel Nautilus 1.0.4
Galeon Browser 1.2
Galeon Browser 1.2.1
Solution:
This issue has been resolved in Mozilla 1.0RC1 builds dated later than May 02, 2002.
Vendor updates are also available:
Mozilla Browser 0.9.7
-
Mozilla mozilla-source-1.0.rc1.tar.gz
Fixed if date is later than May 02, 2002.
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc1/src/mozilla- source-1.0.rc1.tar.gz -
Mozilla mozilla-source-1.0rc3.tar.gz
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc3/src/mozilla- source-1.0rc3.tar.gz
Mozilla Browser 0.9.8
-
Mozilla mozilla-source-1.0.rc1.tar.gz
Fixed if date is later than May 02, 2002.
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc1/src/mozilla- source-1.0.rc1.tar.gz -
Mozilla mozilla-source-1.0rc3.tar.gz
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc3/src/mozilla- source-1.0rc3.tar.gz
Mozilla Browser 0.9.9
-
Mozilla mozilla-source-1.0.rc1.tar.gz
Fixed if date is later than May 02, 2002.
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc1/src/mozilla- source-1.0.rc1.tar.gz -
Mozilla mozilla-source-1.0rc3.tar.gz
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc3/src/mozilla- source-1.0rc3.tar.gz -
Red Hat galeon-1.2.0-4.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/galeon-1.2.0-4.i386.rpm -
Red Hat mozilla-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-0.9.9-12.7.2.i386.rpm -
Red Hat mozilla-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-0.9.9-12.7.3.i386.rpm -
Red Hat mozilla-chat-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-chat-0.9.9-12.7.2.i386 .rpm -
Red Hat mozilla-chat-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-chat-0.9.9-12.7.3.i386 .rpm -
Red Hat mozilla-devel-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-devel-0.9.9-12.7.2.i38 6.rpm -
Red Hat mozilla-devel-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-devel-0.9.9-12.7.3.i38 6.rpm -
Red Hat mozilla-dom-inspector-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-dom-inspector-0.9.9-12 .7.2.i386.rpm -
Red Hat mozilla-dom-inspector-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-dom-inspector-0.9.9-12 .7.3.i386.rpm -
Red Hat mozilla-js-debugger-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-js-debugger-0.9.9-12.7 .2.i386.rpm -
Red Hat mozilla-js-debugger-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-js-debugger-0.9.9-12.7 .3.i386.rpm -
Red Hat mozilla-mail-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-mail-0.9.9-12.7.2.i386 .rpm -
Red Hat mozilla-mail-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-mail-0.9.9-12.7.3.i386 .rpm -
Red Hat mozilla-nspr-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-nspr-0.9.9-12.7.2.i386 .rpm -
Red Hat mozilla-nspr-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-nspr-0.9.9-12.7.3.i386 .rpm -
Red Hat mozilla-nspr-devel-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-nspr-devel-0.9.9-12.7. 2.i386.rpm -
Red Hat mozilla-nspr-devel-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-nspr-devel-0.9.9-12.7. 3.i386.rpm -
Red Hat mozilla-nss-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-nss-0.9.9-12.7.2.i386. rpm -
Red Hat mozilla-nss-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-nss-0.9.9-12.7.3.i386. rpm -
Red Hat mozilla-nss-devel-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-nss-devel-0.9.9-12.7.2 .i386.rpm -
Red Hat mozilla-nss-devel-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-nss-devel-0.9.9-12.7.3 .i386.rpm -
Red Hat mozilla-psm-0.9.9-12.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mozilla-psm-0.9.9-12.7.2.i386. rpm -
Red Hat mozilla-psm-0.9.9-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mozilla-psm-0.9.9-12.7.3.i386. rpm -
Red Hat nautilus-1.0.4-47.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nautilus-1.0.4-47.i386.rpm
Mozilla Browser 1.0 RC1
-
Conectiva mozilla-1.0rc2-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/mozilla-1.0rc2-1U60_1cl.i 386.rpm -
Conectiva mozilla-1.0rc2-1U60_1cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/mozilla-1.0rc2-1U60_1cl. src.rpm -
Conectiva mozilla-1.0rc2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mozilla-1.0rc2-1U70_1cl.i 386.rpm -
Conectiva mozilla-1.0rc2-1U70_1cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/mozilla-1.0rc2-1U70_1cl. src.rpm -
Conectiva mozilla-1.0rc2-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mozilla-1.0rc2-1U8_1cl.i386 .rpm -
Conectiva mozilla-1.0rc2-1U8_1cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/8/SRPMS/mozilla-1.0rc2-1U8_1cl.src .rpm -
Conectiva mozilla-devel-1.0rc2-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/mozilla-devel-1.0rc2-1U60 _1cl.i386.rpm -
Conectiva mozilla-devel-1.0rc2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mozilla-devel-1.0rc2-1U70 _1cl.i386.rpm -
Conectiva mozilla-devel-1.0rc2-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mozilla-devel-1.0rc2-1U8_1c l.i386.rpm -
Conectiva mozilla-devel-static-1.0rc2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mozilla-devel-static-1.0r c2-1U70_1cl.i386.rpm -
Conectiva mozilla-devel-static-1.0rc2-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mozilla-devel-static-1.0rc2 -1U8_1cl.i386.rpm -
Conectiva mozilla-irc-1.0rc2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mozilla-irc-1.0rc2-1U70_1 cl.i386.rpm -
Conectiva mozilla-irc-1.0rc2-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mozilla-irc-1.0rc2-1U8_1cl. i386.rpm -
Conectiva mozilla-mail-1.0rc2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mozilla-mail-1.0rc2-1U70_ 1cl.i386.rpm -
Conectiva mozilla-mail-1.0rc2-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mozilla-mail-1.0rc2-1U8_1cl .i386.rpm -
Conectiva mozilla-psm-1.0rc2-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/mozilla-psm-1.0rc2-1U70_1 cl.i386.rpm -
Conectiva mozilla-psm-1.0rc2-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mozilla-psm-1.0rc2-1U8_1cl. i386.rpm -
Mozilla mozilla-source-1.0.rc1.tar.gz
Fixed if date is later than May 02, 2002.
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc1/src/mozilla- source-1.0.rc1.tar.gz -
Mozilla mozilla-source-1.0rc3.tar.gz
http://ftp.mozilla.org/pub/mozilla/releases/mozilla1.0rc3/src/mozilla- source-1.0rc3.tar.gz
Eazel Nautilus 1.0.4
-
Red Hat nautilus-1.0.4-47.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nautilus-1.0.4-47.i386.rpm -
Red Hat nautilus-devel-1.0.4-47.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nautilus-devel-1.0.4-47.i386.r pm -
Red Hat nautilus-mozilla-1.0.4-47.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nautilus-mozilla-1.0.4-47.i386 .rpm
Galeon Browser 1.2
-
Conectiva galeon-1.2.1-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/galeon-1.2.1-1U8_1cl.i386.r pm -
Conectiva galeon-1.2.1-1U8_1cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/8/SRPMS/galeon-1.2.1-1U8_1cl.src.r pm -
Conectiva galeon-devel-1.2.1-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/galeon-devel-1.2.1-1U8_1cl. i386.rpm -
Red Hat galeon-1.2.0-4.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/galeon-1.2.0-4.i386.rpm
Galeon Browser 1.2.1
-
Conectiva galeon-1.2.1-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/galeon-1.2.1-1U8_1cl.i386.r pm -
Conectiva galeon-1.2.1-1U8_1cl.src.rpm
Source RPM.
ftp://atualizacoes.conectiva.com.br/8/SRPMS/galeon-1.2.1-1U8_1cl.src.r pm -
Conectiva galeon-devel-1.2.1-1U8_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/galeon-devel-1.2.1-1U8_1cl. i386.rpm
References
Mozilla / Netscape 6 XMLHttpRequest File Disclosure Vulnerability
References:
References:
- Mozilla Homepage (Mozilla Foundation)
- Netscape Product Page (Netscape)