Ubuntu Security Notice (C) 2010-2016 Canonical, Inc. / NASL script (C) 2010-2016 Tenable Network Security, Inc.
The remote Ubuntu host is missing one or more security-related
USN-874-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream
changes introduced a regression when using NTLM authentication. This
update fixes the problem and adds additional stability fixes.
We apologize for the inconvenience.
Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay,
engines of Firefox. If a user were tricked into viewing a malicious
website, a remote attacker could cause a denial of service or possibly
execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-3979, CVE-2009-3980, CVE-2009-3982, CVE-2009-3986)
Takehiro Takahashi discovered flaws in the NTLM
implementation in Firefox. If an NTLM authenticated user
visited a malicious website, a remote attacker could send
requests to other applications, authenticated as the user.
Jonathan Morgan discovered that Firefox did not properly
display SSL indicators under certain circumstances. This
could be used by an attacker to spoof an encrypted page,
such as in a phishing attack. (CVE-2009-3984)
Jordi Chancel discovered that Firefox did not properly
display invalid URLs for a blank page. If a user were
tricked into accessing a malicious website, an attacker
could exploit this to spoof the location bar, such as in a
phishing attack. (CVE-2009-3985)
David Keeler, Bob Clary, and Dan Kaminsky discovered several
flaws in third party media libraries. If a user were tricked
into opening a crafted media file, a remote attacker could
cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program.
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Update the affected packages.
Risk factor :
High / CVSS Base Score : 9.3
CVSS Temporal Score : 8.1
Public Exploit Available : false
Family: Ubuntu Local Security Checks
Nessus Plugin ID: 43824 ()
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now