Home Programs Emergency management Response CCIRC Analytical releases2 AV06-035: Mozilla Products Remote Code Execution and Cross Site Scripting Vulnerabilities

Mozilla Products Remote Code Execution and Cross Site Scripting Vulnerabilities

Number: AV06-035
Date: 15 September 2006

Purpose

The purpose of this advisory is to bring attention to multiple vulnerabilities that have been identified in Mozilla Firefox, SeaMonkey, and Thunderbird.

Assessment

Multiple vulnerabilities have been identified in Mozilla Firefox, SeaMonkey, and Thunderbird, which may be exploited by remote attackers to take complete control of an affected system, bypass security restrictions, or disclose sensitive information.

The first issue is due to buffer overflow errors when processing specially crafted JavaScript regular expressions, which could be exploited by attackers to execute arbitrary commands.

The second issue is due to an error in the auto-update mechanism when validating certificates, which could be exploited by attackers to trick users into accepting unverifiable (often self-signed) certificates as valid and redirect them to a malicious web site.

The third vulnerability is due to memory corruption errors during text display, which could be exploited by attackers to crash a vulnerable application and potentially execute arbitrary commands.

The fourth issue is due to an error in the Network Security Services (NSS) library during RSA signature verification, which could be exploited by attackers to forge signatures.

The fifth flaw is due to an origin validation error when handling content injected from a web site into a sub-frame of another site using "targetWindow.frames[n].document.open()", which could be exploited by malicious people to conduct cross-domain scripting attacks.

The sixth vulnerability is due to an error where blocked popups from the status bar (blocked popups) icon are always opened in the context of the site listed in the Location (address) bar, which could be exploited by malicious people to conduct cross-site scripting attacks.

The seventh flaw is due to an error where JavaScript code included in remote XBL files is always executed even if JavaScript has been disabled (by default), which could be exploited by attackers to bypass security restrictions and gain knowledge of sensitive information.

The eighth vulnerability is due to memory corruption errors when handling malformed contents, which could be exploited by attackers to crash a vulnerable application or execute arbitrary commands.

This vulnerability affects the following Mozilla products:

• Mozilla Firefox versions prior to 1.5.0.7
• Mozilla Thunderbird versions prior to 1.5.0.7
• Mozilla SeaMonkey versions prior to 1.0.5
• Mozilla Network Security Service (NSS) versions prior to 3.11.3

Suggested action

PSEPC recommends that administrators test and upgrade to Firefox 1.5.0.7, Thunderbird 1.5.0.7, SeaMonkey 1.0.5, and Network Security Service (NSS) 3.11.3: (http://www.mozilla.org/products)

For more information and instructions, please refer to:

http://www.mozilla.org/security/announce/2006/mfsa2006-64.html
http://www.mozilla.org/security/announce/2006/mfsa2006-63.html
http://www.mozilla.org/security/announce/2006/mfsa2006-62.html
http://www.mozilla.org/security/announce/2006/mfsa2006-61.html
http://www.mozilla.org/security/announce/2006/mfsa2006-60.html
http://www.mozilla.org/security/announce/2006/mfsa2006-59.html
http://www.mozilla.org/security/announce/2006/mfsa2006-58.html
http://www.mozilla.org/security/announce/2006/mfsa2006-57.html

Note to readers

Canadian Cyber Incident Response Centre (CCIRC) collects information related to cyber threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at (613) 991-7000 or goc-cog@psepc.gc.ca by e-mail.

Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at (613) 993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at (613) 993-9620.

For urgent matters or to report any incidents, please contact the Government Operations Centre at:

Phone: (613) 991-7000
Fax: (613) 996-0995
Secure Fax: (613) 991-7094
Email: goc-cog@psepc.gc.ca

For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at:

Telephone: (613) 944-4875 or 1-800-830-3118
Fax: (613) 998-9589
E-mail: communications@psepc.gc.ca