Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 regression (USN-877-1)

Ubuntu Security Notice (C) 2010-2013 Canonical, Inc. / NASL script (C) 2010-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

USN-873-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream
changes introduced a regression when using NTLM authentication. This
update fixes the problem and adds additional stability fixes.

We apologize for the inconvenience.

Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay,
and David James discovered several flaws in the browser and JavaScript
engines of Firefox. If a user were tricked into viewing a malicious
website, a remote attacker could cause a denial of service or possibly
execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-3979, CVE-2009-3981, CVE-2009-3986)

Takehiro Takahashi discovered flaws in the NTLM
implementation in Firefox. If an NTLM authenticated user
visited a malicious website, a remote attacker could send
requests to other applications, authenticated as the user.
(CVE-2009-3983)

Jonathan Morgan discovered that Firefox did not properly
display SSL indicators under certain circumstances. This
could be used by an attacker to spoof an encrypted page,
such as in a phishing attack. (CVE-2009-3984)

Jordi Chancel discovered that Firefox did not properly
display invalid URLs for a blank page. If a user were
tricked into accessing a malicious website, an attacker
could exploit this to spoof the location bar, such as in a
phishing attack. (CVE-2009-3985).

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 43823 ()

Bugtraq ID:

CVE ID: CVE-2009-3979
CVE-2009-3981
CVE-2009-3983
CVE-2009-3984
CVE-2009-3985
CVE-2009-3986