----------------------------------------------------------------------

Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS

Request Trial:
https://ca.secunia.com/?f=l

----------------------------------------------------------------------

TITLE:
Mozilla / Firefox / Thunderbird Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA14407

VERIFY ADVISORY:
http://secunia.com/advisories/14407/

CRITICAL:
Moderately critical

IMPACT:
Spoofing, Manipulation of data, Exposure of system information,
Exposure of sensitive information, Privilege escalation, System
access

WHERE:
>From remote

SOFTWARE:
Mozilla 0.x
http://secunia.com/product/772/
Mozilla 1.0
http://secunia.com/product/97/
Mozilla 1.1
http://secunia.com/product/98/
Mozilla 1.2
http://secunia.com/product/3100/
Mozilla 1.3
http://secunia.com/product/1480/
Mozilla 1.4
http://secunia.com/product/1481/
Mozilla 1.5
http://secunia.com/product/2478/
Mozilla 1.6
http://secunia.com/product/3101/
Mozilla 1.7.x
http://secunia.com/product/3691/
Mozilla Firefox 0.x
http://secunia.com/product/3256/
Mozilla Firefox 1.x
http://secunia.com/product/4227/
Mozilla Thunderbird 0.x
http://secunia.com/product/2637/
Mozilla Thunderbird 1.x
http://secunia.com/product/4652/

DESCRIPTION:
Details have been released about several vulnerabilities in Firefox,
Mozilla and Thunderbird. These can be exploited by malicious, local
users to perform certain actions on a vulnerable system with
escalated privileges and by malicious people to conduct spoofing
attacks, disclose and manipulate sensitive information, and
potentially compromise a user's system.

1) The vulnerability is caused due to the temporary plugin directory
being created insecurely. This can be exploited via symlink attacks
to delete arbitrary directories with the privileges of the user
running Mozilla or Firefox.

2) The problem is that an inactive tab can launch an HTTP
authentication prompt, which appears to be displayed by a website in
another tab. This may be exploited to trick a user into entering some
sensitive information (e.g. user credentials).

This is similar to:
SA12712

3) An error in the handling of shortcut files (.lnk) can be exploited
to overwrite arbitrary files by tricking a user into downloading a
shortcut file twice.

4) The problem is that a XML document can include XSLT stylesheets
from arbitrary sites, which may be exploited to disclose some
sensitive information.

5) An error in the form fill feature (autocomplete) allows reading
suggested values before they are chosen. This can be exploited to
disclose some potentially sensitive input by tricking a user into
arrowing through some autocompleted values.

6) A memory handling error in Mozilla string classes may allow
overwriting of memory if the browser runs out of memory during string
growth. This can potentially be exploited to execute arbitrary code.

7) The problem is that the hostname can be obfuscated in the
installation confirmation dialog by including an overly long username
and password. This can be exploited to trick users into accepting
installations from untrusted sources.

Successful exploitation requires that the malicious website is
allowed to request installations.

8) It is possible to cause a heap overflow due to an error when
converting malformed UTF8 character sequences to Unicode. This may be
exploited to cause a heap overflow and execute arbitrary code,
however, general web content is not converted using the vulnerable
code.

9) Various errors make it possible to show the "secure site" lock
icon with certificate information belonging to a different site.

SOLUTION:
Firefox:
Update to version 1.0.1.
http://www.mozilla.org/products/firefox/

Mozilla:
The vulnerabilities have been fixed in the CVS repository and will be
included in the upcoming 1.7.6 version.

Thunderbird:
The vulnerabilities have been fixed in the CVS repository and will be
included in the upcoming 1.0.1 version.

PROVIDED AND/OR DISCOVERED BY:
1) Tavis Ormandy
2) Christian Schmidt
3) Masayuki Nakano
4) Georgi Guninski
5) Matt Brubeck
6) Independently discovered by:
* Daniel de Wildt
* Gaël Delalleau
7) Phil Ringnalda
8) wind li
9) Mook, Doug Turner, Kohei Yoshino, M. Deaudelin

ORIGINAL ADVISORY:
1) http://www.mozilla.org/security/announce/mfsa2005-28.html

2) http://www.mozilla.org/security/announce/mfsa2005-24.html

3) http://www.mozilla.org/security/announce/mfsa2005-21.html

4) http://www.mozilla.org/security/announce/mfsa2005-20.html

5) http://www.mozilla.org/security/announce/mfsa2005-19.html

6) Mozilla:
http://www.mozilla.org/security/announce/mfsa2005-18.html

iDEFENSE:
http://www.idefense.com/application/poi/display?id=200&type=vulnerabilities

7) http://www.mozilla.org/security/announce/mfsa2005-17.html

8) http://www.mozilla.org/security/announce/mfsa2005-15.html

9) http://www.mozilla.org/security/announce/mfsa2005-14.html

OTHER REFERENCES:
SA12712:
http://secunia.com/advisories/12712/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------