Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.

Maurycy Prodeus reports a critical vulnerability in Mozilla-based browsers :

Mozilla browser supports NNTP urls. Remote side is able to trigger news:// connection to any server. I found a flaw in NNTP handling code which may cause heap overflow and allow remote attacker to execute arbitrary code on client machine.

Updated mozilla packages that fix a buffer overflow issue are now available.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

iSEC Security Research has discovered a buffer overflow bug in the way Mozilla handles NNTP URLs. If a user visits a malicious web page or is convinced to click on a malicious link, it may be possible for an attacker to execute arbitrary code on the victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1316 to this issue.

Users of Mozilla should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

The remote version of Mozilla is vulnerable to a heap overflow attack against its NNTP functionality. 

This may allow an attacker to execute arbitrary code on the remote host. 

To exploit this flaw, an attacker would need to set up a rogue news site and lure a victim on the remote host into reading news from it.

Versions of Mozilla Firefox prior to 1.7.5 are vulnerable to a heap overflow against its NNTP functionality. This may allow an attacker to execute arbitrary code on the remote host. To exploit this flaw, an attacker would need to set up a rogue website and lure a victim on the remote host into visiting it. 

The remote host is using Firefox. The remote version of this software contains a security issue that may allow an attacker to determine existence of local files, cause a DoS and steal passwords (Windows only). The security vulnerability is due to the fact that Firefox does not handle correctly <IMG> tags. 

ID	Name	Product	Family	Severity
18912	FreeBSD : mozilla -- heap overflow in NNTP handler (3fbf9db2-658b-11d9-abad-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	medium
16160	RHEL 2.1 / 3 : mozilla (RHSA-2005:038)	Nessus	Red Hat Local Security Checks	medium
16085	Mozilla nsNNTPProtocol.cpp NNTP news:// URI Handling Overflow DoS	Nessus	Windows	high
2481	Mozilla Firefox < 1.7.5 NNTP Remote Heap Overflow	Nessus Network Monitor	Web Clients	medium
2402	Mozilla Firefox < 1.0.0 IMG Tag Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2004-1316

medium

Tenable Plugins

medium

medium

high

medium

medium