Heap-based buffer overflow in the UTF8ToNewUnicode function for Firefox before 1.0.1 and Mozilla before 1.7.6 might allow remote attackers to cause a denial of service (crash) or execute arbitrary code via invalid sequences in a UTF8 encoded string that result in a zero length value.

USN-149-1 fixed some vulnerabilities in the Ubuntu 5.04 (Hoary Hedgehog) version of Firefox. The version shipped with Ubuntu 4.10 (Warty Warthog) is also vulnerable to these flaws, so it needs to be upgraded as well. Please see

http://www.ubuntulinux.org/support/documentation/usn/usn-149-1

for the original advisory.

This update also fixes several older vulnerabilities; Some of them could be exploited to execute arbitrary code with full user privileges if the user visited a malicious website. (MFSA-2005-01 to MFSA-2005-44; please see the following website for details:
http://www.mozilla.org/projects/security/known-vulnerabilities.html)

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200503-32 (Mozilla Thunderbird: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in Mozilla     Thunderbird:
    Mark Dowd from ISS X-Force reported an     exploitable heap overrun in the GIF processing of obsolete Netscape     extension 2 (CAN-2005-0399)     Daniel de Wildt and Gael Delalleau     discovered a memory overwrite in a string library (CAN-2005-0255)     Wind Li discovered a possible heap overflow in UTF8 to Unicode     conversion (CAN-2005-0592)     Phil Ringnalda reported a possible     way to spoof Install source with user:pass@host (CAN-2005-0590)   Impact :

    The GIF heap overflow could be triggered by a malicious GIF image     that would end up executing arbitrary code with the rights of the user     running Thunderbird. The other overflow issues, while not thought to be     exploitable, would have the same impact. Furthermore, by setting up     malicious websites and convincing users to follow untrusted links,     attackers may leverage the spoofing issue to trick user into installing     malicious extensions.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200503-30 (Mozilla Suite: Multiple vulnerabilities)

    The following vulnerabilities were found and fixed in the Mozilla     Suite:
    Mark Dowd from ISS X-Force reported an exploitable     heap overrun in the GIF processing of obsolete Netscape extension 2     (CAN-2005-0399)     Michael Krax reported that plugins can be used     to load privileged content and trick the user to interact with it     (CAN-2005-0232, CAN-2005-0527)     Michael Krax also reported     potential spoofing or cross-site-scripting issues through overlapping     windows, image or scrollbar drag-and-drop, and by dropping javascript:
    links on tabs (CAN-2005-0230, CAN-2005-0231, CAN-2005-0401,     CAN-2005-0591)     Daniel de Wildt and Gael Delalleau discovered a     memory overwrite in a string library (CAN-2005-0255)     Wind Li     discovered a possible heap overflow in UTF8 to Unicode conversion     (CAN-2005-0592)     Eric Johanson reported that Internationalized     Domain Name (IDN) features allow homograph attacks (CAN-2005-0233)     Mook, Doug Turner, Kohei Yoshino and M. Deaudelin reported various     ways of spoofing the SSL 'secure site' indicator (CAN-2005-0593)     Georgi Guninski discovered that XSLT can include stylesheets from     arbitrary hosts (CAN-2005-0588)     Secunia discovered a way of     injecting content into a popup opened by another website     (CAN-2004-1156)     Phil Ringnalda reported a possible way to     spoof Install source with user:pass@host (CAN-2005-0590)     Jakob     Balle from Secunia discovered a possible way of spoofing the Download     dialog source (CAN-2005-0585)     Christian Schmidt reported a     potential spoofing issue in HTTP auth prompt tab (CAN-2005-0584)     Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team     discovered that Mozilla insecurely creates temporary filenames in     /tmp/plugtmp (CAN-2005-0578)   Impact :

    The GIF heap overflow could be triggered by a malicious GIF     image that would end up executing arbitrary code with the rights of the     user running Mozilla. The other overflow issues, while not thought to     be exploitable, would have the same impact     By setting up     malicious websites and convincing users to follow untrusted links or     obey very specific drag-and-drop or download instructions, attackers     may leverage the various spoofing issues to fake other websites to get     access to confidential information, push users to download malicious     files or make them interact with their browser preferences     The     temporary directory issue allows local attackers to overwrite arbitrary     files with the rights of another local user   Workaround :

    There is no known workaround at this time.

The remote version of Mozilla contains multiple security issues that could allow an attacker to impersonate a website and to trick a user into accepting and executing arbitrary files or to cause a heap overflow in the FireFox process and execute arbitrary code on the remote host.

The remote host is affected by the vulnerability described in GLSA-200503-10 (Mozilla Firefox: Various vulnerabilities)

    The following vulnerabilities were found and fixed in Mozilla     Firefox:
    Michael Krax reported that plugins can be used     to load privileged content and trick the user to interact with it     (CAN-2005-0232, CAN-2005-0527)     Michael Krax also reported     potential spoofing or cross-site-scripting issues through overlapping     windows, image drag-and-drop, and by dropping javascript: links on tabs     (CAN-2005-0230, CAN-2005-0231, CAN-2005-0591)     Daniel de Wildt     and Gael Delalleau discovered a memory overwrite in a string library     (CAN-2005-0255)     Wind Li discovered a possible heap overflow in     UTF8 to Unicode conversion (CAN-2005-0592)     Eric Johanson     reported that Internationalized Domain Name (IDN) features allow     homograph attacks (CAN-2005-0233)     Mook, Doug Turner, Kohei     Yoshino and M. Deaudelin reported various ways of spoofing the SSL     'secure site' indicator (CAN-2005-0593)     Matt Brubeck reported     a possible Autocomplete data leak (CAN-2005-0589)     Georgi     Guninski discovered that XSLT can include stylesheets from arbitrary     hosts (CAN-2005-0588)     Secunia discovered a way of injecting     content into a popup opened by another website (CAN-2004-1156)     Phil Ringnalda reported a possible way to spoof Install source with     user:pass@host (CAN-2005-0590)     Jakob Balle from Secunia     discovered a possible way of spoofing the Download dialog source     (CAN-2005-0585)     Christian Schmidt reported a potential     spoofing issue in HTTP auth prompt tab (CAN-2005-0584)     Andreas     Sanblad from Secunia discovered a possible way of spoofing the Download     dialog using the Content-Disposition header (CAN-2005-0586)     Finally, Tavis Ormandy of the Gentoo Linux Security Audit Team     discovered that Firefox insecurely creates temporary filenames in     /tmp/plugtmp (CAN-2005-0578)   Impact :

    By setting up malicious websites and convincing users to     follow untrusted links or obey very specific drag-and-drop or download     instructions, attackers may leverage the various spoofing issues to     fake other websites to get access to confidential information, push     users to download malicious files or make them interact with their     browser preferences.
    The temporary directory issue allows     local attackers to overwrite arbitrary files with the rights of another     local user.
    The overflow issues, while not thought to be     exploitable, may allow a malicious downloaded page to execute arbitrary     code with the rights of the user viewing the page.
  Workaround :

    There is no known workaround at this time.

stripped_description=Versions of Mozilla Firefox prior to 1.7.6 are affected by the following vulnerabilities :

 - There is a flaw in the way that the browser handles scripting within 'tabbed' cross-domains.  An attacker exploiting this flaw would need to be able to convince a user to click on a malicious URL which would then open a separate 'TAB' within the browser.  The attacker could then retrieve data relevant to other tabbed connections or execute code locally.
 - There is a flaw in the default 'about: config' script that would allow an attacker to modify configuration data.  In order to execute such an attack, the attacker would need to be able to entice the user into visiting or clicking on a malicious URL.  A successful attacker would be able to modify the local configuration file, resulting in enhanced access rights or other potential exploits.  In addition, there are other unconfirmed flaws in Mozilla version 1.7.5 and lower. 

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:176 advisory.

  - security flaw (CVE-2004-1156, CVE-2005-0231, CVE-2005-0232, CVE-2005-0233, CVE-2005-0255, CVE-2005-0527,     CVE-2005-0578, CVE-2005-0584, CVE-2005-0585, CVE-2005-0586, CVE-2005-0588, CVE-2005-0589, CVE-2005-0590,     CVE-2005-0591, CVE-2005-0592, CVE-2005-0593)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is using Firefox. The remote version of this software contains the following security flaws: 
1) There is a flaw in the way that the browser handle scripting within 'tabbed' cross-domains.  An attacker exploiting this flaw would need to be able to coerce a user into clicking on a malicious URL which would then open a separate 'TAB' within the browser.  The attacker could then retrieve data relevant to other tabbed connections or execute code locally.
2)There is a flaw in the default about: config script that would allow an attacker to modify configuration data. In order to execute such an attack, the attacker would need to be able to entice the user into visiting or clicking on a malicious URL.  A successful attacker would be able to modify the local configuration file, resulting in enhanced access rights or other potential exploits.

The installed version of Firefox is earlier than 1.0.1.  Such versions have multiple security issues, including vulnerabilities that could allow an attacker to impersonate a website by using an International Domain Name, or vulnerabilities that could allow arbitrary code execution.

The remote host is using Mozilla, a web browser. The remote version of this software contains the following security flaws: 
1) There is a flaw in the way that the browser handles scripting within 'tabbed' cross-domains.  An attacker exploiting this flaw would need to be able to convince a user to click on a malicious URL which would then open a separate 'TAB' within the browser.  The attacker could then retrieve data relevant to other tabbed connections or execute code locally.
2)There is a flaw in the default about: config script that would allow an attacker to modify configuration data.  In order to execute such an attack, the attacker would need to be able to entice the user into visiting or clicking on a malicious URL.  A successful attacker would be able to modify the local configuration file, resulting in enhanced access rights or other potential exploits.  In addition, there are other unconfirmed flaws in Mozilla version 1.7.5 and lower.

ID	Name	Product	Family	Severity
20546	Ubuntu 4.10 : mozilla-firefox vulnerabilities (USN-149-3)	Nessus	Ubuntu Local Security Checks	high
17632	GLSA-200503-32 : Mozilla Thunderbird: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
17619	GLSA-200503-30 : Mozilla Suite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
17604	Mozilla Browser < 1.7.6 Multiple Vulnerabilities	Nessus	Windows	high
17276	GLSA-200503-10 : Mozilla Firefox: Various vulnerabilities	Nessus	Gentoo Local Security Checks	high
2671	Mozilla Firefox < 1.7.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
17252	RHEL 4 : firefox (RHSA-2005:176)	Nessus	Red Hat Local Security Checks	high
2652	Mozilla Firefox < 1.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
17218	Firefox < 1.0.1 Multiple Vulnerabilities	Nessus	Windows	high
801215	Mozilla < 1.7.6 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800757	Firefox < 1.0.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2005-0592

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

medium