SynopsisThe remote Red Hat host is missing a security update.
DescriptionAn updated firefox package that fixes various security bugs is now available for Red Hat Enterprise Linux 4.
This update has been rated as having important security impact by the Red Hat Security Response Team.
Mozilla Firefox is an open source Web browser.
A bug was found in the way Firefox set an image as the desktop wallpaper. If a user chooses the 'Set As Wallpaper...' context menu item on a specially crafted image, it is possible for an attacker to execute arbitrary code on a victim's machine. (CVE-2005-2262)
A bug was found in the way Firefox installed its extensions. If a user can be tricked into visiting a malicious webpage, it may be possible to obtain sensitive information such as cookies or passwords.
A bug was found in the way Firefox handled multiple frame domains. It is possible for a frame as part of a malicious website to inject content into a frame that belongs to another domain. This issue was previously fixed as CVE-2004-0718 but was accidentally disabled.
A bug was found in the way Firefox handled child frames. It is possible for a malicious framed page to steal sensitive information from its parent page. (CVE-2005-2266)
A bug was found in the way Firefox cloned base objects. It is possible for Web content to navigate up the prototype chain to gain access to privileged chrome objects. (CVE-2005-2270)
Users of Firefox are advised to upgrade to this updated package that contains Firefox version 1.0.6 and is not vulnerable to these issues.
SolutionUpdate the affected firefox package.
File Name: redhat-RHSA-2005-586.nasl
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent
CPE: p-cpe:/a:redhat:enterprise_linux:firefox, cpe:/o:redhat:enterprise_linux:4
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Exploit Ease: Exploits are available
Patch Publication Date: 7/21/2005
Vulnerability Publication Date: 7/27/2004
Metasploit (Mozilla Suite/Firefox compareTo() Code Execution)
CVE: CVE-2004-0718, CVE-2005-1937, CVE-2005-2114, CVE-2005-2260, CVE-2005-2261, CVE-2005-2262, CVE-2005-2263, CVE-2005-2264, CVE-2005-2265, CVE-2005-2266, CVE-2005-2267, CVE-2005-2268, CVE-2005-2269, CVE-2005-2270