Mozilla Firefox Firebug Extension 'chrome:' Cross Domain Scripting Vulnerability

Bugtraq ID:	48340
Class:	Origin Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 20 2011 12:00AM
Updated:	Jun 21 2011 08:20PM
Credit:	5up3rh3i
Vulnerable:	Firebug Firebug 1.7.2
Not Vulnerable:	Firebug Firebug 1.7.3

Mozilla Firefox Firebug Extension 'chrome:' Cross Domain Scripting Vulnerability

The Firebug extension for Mozilla Firefox prone to a cross-domain scripting vulnerability.

A remote attacker can exploit this vulnerability to bypass the same-origin policy, execute arbitrary script code with 'chrome' privileges and obtain potentially sensitive information, or launch spoofing attacks against other sites.

Firebug 1.7.2 is vulnerable; other versions may also be affected.

Mozilla Firefox Firebug Extension 'chrome:' Cross Domain Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.

Mozilla Firefox Firebug Extension 'chrome:' Cross Domain Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mozilla Firefox Firebug Extension 'chrome:' Cross Domain Scripting Vulnerability

References:

• Firebug Firefox Extension Cross Context Scripting Vulnerability (5up3rh3i)
  
• Firebug Homepage (Joe Hewitt)
  
• Firebug Releases (Firebug)