Ubuntu 5.04 : mozilla-firefox, mozilla vulnerabilities (USN-124-1)

Ubuntu Security Notice (C) 2005-2013 Canonical, Inc. / NASL script (C) 2006-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

When a popup is blocked the user is given the ability to open that
popup through the popup-blocking status bar icon and, in Firefox,
through the information bar. Doron Rosenberg noticed that popups which
are permitted by the user were executed with elevated privileges,
which could be abused to automatically install and execute arbitrary
code with the privileges of the user. (CAN-2005-1153)

It was discovered that the browser did not start with a clean global
JavaScript state for each new website. This allowed a malicious web
page to define a global variable known to be used by a different site,
allowing malicious code to be executed in the context of that site
(for example, sending web mail or automatic purchasing).
(CAN-2005-1154)

Michael Krax discovered a flaw in the 'favicon' links handler. A
malicious web page could define a favicon link tag as JavaScript,
which could be exploited to execute arbitrary code with the privileges
of the user. (CAN-2005-1155)

Michael Krax found two flaws in the Search Plugin installation. This
allowed malicious plugins to execute arbitrary code in the context of
the current site. If the current page had elevated privileges (like
'about:plugins' or 'about:config'), the malicious plugin could even
install malicious software when a search was performed.
(CAN-2005-1156, CAN-2005-1157)

Kohei Yoshino discovered two missing security checks when Firefox
opens links in its sidebar. This allowed a malicious web page to
construct a link that, when clicked on, could execute arbitrary
JavaScript code with the privileges of the user. (CAN-2005-1158)

Georgi Guninski discovered that the types of certain XPInstall related
JavaScript objects were not sufficiently validated when they were
called. This could be exploited by a malicious website to crash
Firefox or even execute arbitrary code with the privileges of the
user. (CAN-2005-1159)

Firefox did not properly verify the values of XML DOM nodes of web
pages. By tricking the user to perform a common action like clicking
on a link or opening the context menu, a malicious page could exploit
this to execute arbitrary JavaScript code with the full privileges of
the user. (CAN-2005-1160).

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 20513 ()

Bugtraq ID:

CVE ID: CVE-2005-1153
CVE-2005-1154
CVE-2005-1155
CVE-2005-1156
CVE-2005-1157
CVE-2005-1158
CVE-2005-1159
CVE-2005-1160