This script is Copyright (C) 2009-2017 Tenable Network Security, Inc.
The remote Windows host contains a web browser that is affected by
The installed version of Firefox is earlier than 3.0.9. Such versions
are potentially affected by the following security issues :
- Multiple remote memory corruption vulnerabilities exist
that can be exploited to execute arbitrary code in the
context of the user running the affected application.
- A flaw may exist where Unicode box drawing characters
are allowed in Internationalized Domain Names where they
could be visually confused with punctuation used in
valid web addresses. An attacker can leverage this to
launch a phishing-type scam against a victim.
- A vulnerability exists when the 'jar:' scheme is used to
wrap a URI which serves the content with
'Content-Disposition: attachment'. An attacker can
leverage this to subvert sites that use this mechanism
to mitigate content injection attacks. (MFSA 2009-16)
- When an Adobe Flash file is loaded via the
'view-source:' scheme, the Flash plugin misinterprets
the origin of the content as localhost. An attacker can
leverage this to launch cross-site request forgery
attacks. It is also possible to exploit this to place
cookie-like objects on victim's computers.
- A vulnerability exists that allows attackers to inject
arbitrary scripts into sites via XBL bindings. This
vulnerability requires the attacker to have the ability
to embed third-party stylesheets into the site.
- Multiple remote code execution vulnerabilities exist
caused by the creation of documents whose URI does not
match the document's principle using XMLHttpRequest, as
well as a flaw in the 'XPCNativeWrapper.ToString'
'__proto__' coming from the wrong scope. (MFSA 2009-19)
- A malicious MozSearch plugin could be created using a
leverage this in order to inject code into arbitrary
sites. (MFSA 2009-20)
- An information disclosure vulnerability exists when
saving the inner frame of a web page as a file when the
outer page has POST data associated with it.
- A cross-site scripting vulnerability exists when
See also :
Upgrade to Firefox 3.0.9 or later.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 7.7
Public Exploit Available : true
Nessus Plugin ID: 36215 ()
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now