CVE-2004-0762

MEDIUM

Description

Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.

References

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt

http://archives.neohapsis.com/archives/fulldisclosure/2004-07/0264.html

http://bugzilla.mozilla.org/show_bug.cgi?id=162020

http://marc.info/?l=bugtraq&m=109900315219363&w=2

http://secunia.com/advisories/11999/

http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7

http://www.novell.com/linux/security/advisories/2004_36_mozilla.html

http://www.redhat.com/support/errata/RHSA-2004-421.html

http://www.securityfocus.com/bid/15495

http://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/

https://exchange.xforce.ibmcloud.com/vulnerabilities/16623

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10032

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4403

Details

Source: MITRE

Published: 2004-08-18

Updated: 2017-10-11

Type: NVD-CWE-Other

Risk Information

CVSS v2.0

Base Score: 5

Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Tenable Plugins

View all (42 total)

ID	Name	Product	Family	Severity
3239	Mozilla Firefox < 1.0.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
3238	Mozilla Firefox < 1.7.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
3099	Mozilla Firefox < 1.0.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
19068	FreeBSD : mozilla -- users may be lured into bypassing security dialogs (a7e0d783-131b-11d9-bc4a-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	medium
18794	Slackware 10.0 / 9.1 / current : Mozilla (SSA:2004-223-01)	Nessus	Slackware Local Security Checks	critical
3067	Mozilla Firefox < 1.7.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
3066	Mozilla Firefox < 1.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2902	Mozilla Firefox < 1.7.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2887	Mozilla Firefox < 1.0.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2789	Mozilla Firefox < 1.7.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2788	Mozilla Firefox < 1.0.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2703	Mozilla Thunderbird < 1.0.2 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	SMTP Clients	medium
2671	Mozilla Firefox < 1.7.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2652	Mozilla Firefox < 1.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
2603	MSN Messenger < 6.2.0205 PNG File Remote Overflow (deprecated)	Nessus Network Monitor	Internet Messengers	medium
2602	Microsoft Media Player Version 9 PNG Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Generic	medium
14331	Mandrake Linux Security Advisory : mozilla (MDKSA-2004:082)	Nessus	Mandriva Local Security Checks	critical
1775	Mozilla Firefox XML User Interface Language Browser Interface Spoofing (deprecated)	Nessus Network Monitor	Web Clients	medium
1773	Mozilla Firefox < 1.7.1 / Thunderbird < 0.7.1 POP3 Remote Heap Overflow (deprecated)	Nessus Network Monitor	Web Clients	medium
1772	Mozilla Firefox < 1.7.1 Cross-Domain Frame Loading Vulnerability (deprecated)	Nessus Network Monitor	Web Clients	medium
1771	Mozilla Firefox < 1.7.2 Non-FQDN SSL Certificate Spoofing	Nessus Network Monitor	Web Clients	medium
1770	Mozilla Firefox < 1.7.1 SSL Redirect Spoofing	Nessus Network Monitor	Web Clients	medium
2116	Mozilla Firefox Input Type HTML Tag Unauthorized Access (deprecated)	Nessus Network Monitor	Web Clients	medium
14214	RHEL 2.1 / 3 : mozilla (RHSA-2004:421)	Nessus	Red Hat Local Security Checks	critical
801373	Mozilla XML User Interface Language Browser Interface Spoofing	Log Correlation Engine	Web Clients	medium
801318	Mozilla Browser < 1.7.8 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801295	Mozilla Firefox < 1.0.4 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801294	Mozilla Browser < 1.7.12 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801293	Mozilla < 1.7.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801292	Mozilla Browser < 1.7.2 Non-FQDN SSL Certificate Spoofing	Log Correlation Engine	Web Clients	medium
801263	Mozilla < 1.7.1 SSL Redirect Spoofing	Log Correlation Engine	Web Clients	medium
801257	Mozilla Browser < 1.7.10 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801229	Mozilla Browser Input Type HTML Tag Unauthorized Access	Log Correlation Engine	Web Clients	medium
801228	Mozilla < 1.7.1 Cross-Domain Frame Loading Vulnerability	Log Correlation Engine	Web Clients	medium
801221	Mozilla Thunderbird < 1.0.2 Multiple Vulnerabilities	Log Correlation Engine	SMTP Clients	high
801217	Mozilla Firefox < 1.0.5 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801215	Mozilla < 1.7.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
801211	Mozilla Browser <1.7.1 / Thunderbird < 0.7.1 SendUIDL POP3 Message Handling Remote Heap Overflow	Log Correlation Engine	Web Clients	medium
800781	Firefox < 1.0.7 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800777	Firefox < 1.0.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800757	Firefox < 1.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium
800745	Firefox < 1.0.3 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high