BID:7363

Mozilla Browser Cross Domain Violation Vulnerability

Info

Mozilla Browser Cross Domain Violation Vulnerability

Bugtraq ID:	7363
Class:	Origin Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 16 2003 12:00AM
Updated:	Apr 16 2003 12:00AM
Credit:	Discovery of this vulnerability credited to Liu Die Yu <[email protected]>.
Vulnerable:	Netscape Communicator 6.2.3 Netscape Communicator 7.02 Netscape Communicator 7.01 Netscape Communicator 7.0 + Sun Solaris 9_x86 + Sun Solaris 9 + Sun Solaris 8_x86 + Sun Solaris 8_sparc + Sun Solaris 7.0_x86 + Sun Solaris 7.0 Mozilla Firebird 0.5 Mozilla Browser 1.3 Mozilla Browser 1.2.1 Mozilla Browser 1.2 Beta Mozilla Browser 1.2 Alpha Mozilla Browser 1.2 Mozilla Browser 1.1 Beta Mozilla Browser 1.1 Alpha Mozilla Browser 1.1 Mozilla Browser 1.0.1 Mozilla Browser 1.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 HP HP-UX 11.22 HP HP-UX 11.11 HP HP-UX 11.0 Beonex Communicator 0.8.2

Not Vulnerable:	Mozilla Browser 1.5 Mozilla Browser 1.4.1 Mozilla Browser 1.4 b Mozilla Browser 1.4 a Mozilla Browser 1.4 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2

Discussion

Mozilla Browser Cross Domain Violation Vulnerability

A problem has been reported in Mozilla that could allow access to information in other browser windows.

Upon the execution of code through the 'onclick' property, a violation in browser security zone policy would occur that allows the original web site to view the contents of web pages in other browser windows.

Other browsers based on the Mozilla codebase are vulnerable to this issue.

Solution / Fix

Mozilla Browser Cross Domain Violation Vulnerability

Solution:
HP has announced that this vulnerability has been addressed by the patches included in HPSBUX0401-311. Additional information regarding obtaining and applying appropriate patches can be found in the referenced advisory.

Mozilla have released an update to address this issue:

Mozilla Browser 1.0