Ubuntu 6.06 LTS : firefox regression (USN-428-2)

Ubuntu Security Notice (C) 2007-2014 Canonical, Inc. / NASL script (C) 2007-2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

USN-428-1 fixed vulnerabilities in Firefox 1.5. However, changes to
library paths caused applications depending on libnss3 to fail to
start up. This update fixes the problem.

We apologize for the inconvenience.

Several flaws have been found that could be used to perform Cross-site
scripting attacks. A malicious web site could exploit these to modify
the contents or steal confidential data (such as passwords) from other
opened web pages. (CVE-2006-6077, CVE-2007-0780, CVE-2007-0800,
CVE-2007-0981, CVE-2007-0995, CVE-2007-0996)

The SSLv2 protocol support in the NSS library did not
sufficiently check the validity of public keys presented
with a SSL certificate. A malicious SSL web site using SSLv2
could potentially exploit this to execute arbitrary code
with the user's privileges. (CVE-2007-0008)

The SSLv2 protocol support in the NSS library did not
sufficiently verify the validity of client master keys
presented in an SSL client certificate. A remote attacker
could exploit this to execute arbitrary code in a server
application that uses the NSS library. (CVE-2007-0009)

Various flaws have been reported that could allow an
attacker to execute arbitrary code with user privileges by
tricking the user into opening a malicious web page.
(CVE-2007-0775, CVE-2007-0776, CVE-2007-0777, CVE-2007-1092)

Two web pages could collide in the disk cache with the
result that depending on order loaded the end of the longer
document could be appended to the shorter when the shorter
one was reloaded from the cache. It is possible a determined
hacker could construct a targeted attack to steal some
sensitive data from a particular web page. The potential
victim would have to be already logged into the targeted
service (or be fooled into doing so) and then visit the
malicious site. (CVE-2007-0778)

David Eckel reported that browser UI elements--such as the
host name and security indicators--could be spoofed by using
custom cursor images and a specially crafted style sheet.
(CVE-2007-0779).

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.1
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true