SuSE 11 / 11.1 Security Update : Mozilla Firefox (SAT Patch Numbers 3455 / 3456)

This script is Copyright (C) 2010-2013 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 11 host is missing one or more security updates.

Description :

This update brings Mozilla Firefox to version 3.6.12, fixing various
bugs and security issues.

The following security issues were fixed :

- Mozilla developers identified and fixed several memory
safety bugs in the browser engine used in Firefox and
other Mozilla-based products. Some of these bugs showed
evidence of memory corruption under certain
circumstances, and we presume that with enough effort at
least some of these could be exploited to run arbitrary
code. References. (MFSA 2010-64)

Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor
Bukanov and Josh Soref reported memory safety problems
that affected Firefox 3.6 and Firefox 3.5.

- Memory safety bugs - Firefox 3.6, Firefox 3.5

- Gary Kwong, Martijn Wargers and Siddharth Agarwal
reported memory safety problems that affected Firefox
3.6 only. (CVE-2010-3176)

- Memory safety bugs - Firefox 3.6

- CVE-2010-3175

- Security researcher Alexander Miller reported that
passing an excessively long string to document.write
could cause text rendering routines to end up in an
inconsistent state with sections of stack memory being
overwritten with the string data. An attacker could use
this flaw to crash a victim's browser and potentially
run arbitrary code on their computer. (MFSA 2010-65 /
CVE-2010-3179)

- Security researcher Sergey Glazunov reported that it was
possible to access the locationbar property of a window
object after it had been closed. Since the closed
window's memory could have been subsequently reused by
the system it was possible that an attempt to access the
locationbar property could result in the execution of
attacker-controlled memory. (MFSA 2010-66 /
CVE-2010-3180)

- Security researcher regenrecht reported via
TippingPoint's Zero Day Initiative that when
window.lookupGetter is called with no arguments the code
assumes the top JavaScript stack value is a property
name. Since there were no arguments passed into the
function, the top value could represent uninitialized
memory or a pointer to a previously freed JavaScript
object. Under such circumstances the value is passed to
another subroutine which calls through the dangling
pointer, potentially executing attacker-controlled
memory. (MFSA 2010-67 / CVE-2010-3183)

- Google security researcher Robert Swiecki reported that
functions used by the Gopher parser to convert text to
HTML tags could be exploited to turn text into
executable JavaScript. If an attacker could create a
file or directory on a Gopher server with the encoded
script as part of its name the script would then run in
a victim's browser within the context of the site. (MFSA
2010-68 / CVE-2010-3177)

- Security researcher Eduardo Vela Nava reported that if a
web page opened a new window and used a javascript: URL
to make a modal call, such as alert(), then subsequently
navigated the page to a different domain, once the modal
call returned the opener of the window could get access
to objects in the navigated window. This is a violation
of the same-origin policy and could be used by an
attacker to steal information from another web site.
(MFSA 2010-69 / CVE-2010-3178)

- Security researcher Richard Moore reported that when an
SSL certificate was created with a common name
containing a wildcard followed by a partial IP address a
valid SSL connection could be established with a server
whose IP address matched the wildcard range by browsing
directly to the IP address. It is extremely unlikely
that such a certificate would be issued by a Certificate
Authority. (MFSA 2010-70 / CVE-2010-3170)

- Dmitri Gribenko reported that the script used to launch
Mozilla applications on Linux was effectively including
the current working directory in the LDLIBRARYPATH
environment variable. If an attacker was able to place
into the current working directory a malicious shared
library with the same name as a library that the
bootstrapping script depends on the attacker could have
their library loaded instead of the legitimate library.
(MFSA 2010-71 / CVE-2010-3182)

- Morten Krokvik of Telenor SOC reported an exploit
targeting particular versions of Firefox 3.6 on Windows
XP that Telenor found while investigating an intrusion
attempt on a customer network. The underlying
vulnerability, however, was present on both the Firefox
3.5 and Firefox 3.6 development branches and affected
all supported platforms. (MFSA 2010-73 / CVE-2010-3765)

See also :

http://www.mozilla.org/security/announce/2010/mfsa2010-64.html
http://www.mozilla.org/security/announce/2010/mfsa2010-65.html
http://www.mozilla.org/security/announce/2010/mfsa2010-66.html
http://www.mozilla.org/security/announce/2010/mfsa2010-67.html
http://www.mozilla.org/security/announce/2010/mfsa2010-68.html
http://www.mozilla.org/security/announce/2010/mfsa2010-69.html
http://www.mozilla.org/security/announce/2010/mfsa2010-70.html
http://www.mozilla.org/security/announce/2010/mfsa2010-71.html
http://www.mozilla.org/security/announce/2010/mfsa2010-73.html
https://bugzilla.novell.com/show_bug.cgi?id=645315
https://bugzilla.novell.com/show_bug.cgi?id=649492
http://support.novell.com/security/cve/CVE-2010-3170.html
http://support.novell.com/security/cve/CVE-2010-3174.html
http://support.novell.com/security/cve/CVE-2010-3175.html
http://support.novell.com/security/cve/CVE-2010-3176.html
http://support.novell.com/security/cve/CVE-2010-3177.html
http://support.novell.com/security/cve/CVE-2010-3178.html
http://support.novell.com/security/cve/CVE-2010-3179.html
http://support.novell.com/security/cve/CVE-2010-3180.html
http://support.novell.com/security/cve/CVE-2010-3182.html
http://support.novell.com/security/cve/CVE-2010-3183.html
http://support.novell.com/security/cve/CVE-2010-3765.html

Solution :

Apply SAT patch number 3455 / 3456 as appropriate.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now