Detections
Analytics
CVE-2008-4582
medium
Description
Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.
References
http://www.us-cert.gov/cas/techalerts/TA08-319A.html
http://www.securitytracker.com/id?1021190
http://www.securityfocus.com/bid/31747
http://www.securityfocus.com/bid/31611
http://www.debian.org/security/2009/dsa-1697
http://www.debian.org/security/2009/dsa-1696
http://www.debian.org/security/2008/dsa-1671
http://www.debian.org/security/2008/dsa-1669
http://ubuntu.com/usn/usn-667-1
http://securitytracker.com/alerts/2008/Nov/1021212.html
http://securityreason.com/securityalert/4416
http://secunia.com/advisories/34501
http://secunia.com/advisories/33434
http://secunia.com/advisories/33433
http://secunia.com/advisories/32853
http://secunia.com/advisories/32845
http://secunia.com/advisories/32778
http://secunia.com/advisories/32721
http://secunia.com/advisories/32714
http://secunia.com/advisories/32693
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00385.html
https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00366.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/45740
https://bugzilla.mozilla.org/show_bug.cgi?id=455311
http://www.vupen.com/english/advisories/2009/0977
http://www.vupen.com/english/advisories/2008/2818
http://www.securityfocus.com/archive/1/497091/100/0/threaded
http://www.mozilla.org/security/announce/2008/mfsa2008-47.html