Firefox 3.5 < 3.5.6 Multiple Vulnerabilities
high Nessus Plugin ID 43174
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote Windows host contains a web browser that is affected by multiple vulnerabilities.Description
The installed version of Firefox is 3.5.x earlier than 3.5.6. Such versions are potentially affected by the following security issues :- Multiple crashes can result in arbitrary code execution. (MFSA 2009-65)
- Multiple vulnerabilities in 'liboggplay' can lead to arbitrary code execution. (MFSA 2009-66)
- An integer overflow in the 'Theora' video library can lead to a crash or the execution of arbitrary code. (MFSA 2009-67)
- The NTLM implementation is vulnerable to reflection attacks in which NTLM credentials from one application can be forwarded to another application. (MFSA 2009-68)
- Multiple location bar spoofing vulnerabilities exist. (MFSA 2009-69)
- A content window which is opened by a chrome window retains a reference to the chrome window via the 'window.opener' property, which can lead to privilege escalation. (MFSA 2009-70)
- The exception messages generated by the 'GeckoActiveXObject' differ based on whether or not the requested COM object's ProgID is present in the system registry. (MFSA 2009-71)
Solution
Upgrade to Firefox 3.5.6 or later.See Also
https://www.mozilla.org/en-US/security/advisories/mfsa2009-65/
https://www.mozilla.org/en-US/security/advisories/mfsa2009-66/
https://www.mozilla.org/en-US/security/advisories/mfsa2009-67/
https://www.mozilla.org/en-US/security/advisories/mfsa2009-68/
https://www.mozilla.org/en-US/security/advisories/mfsa2009-69/
https://www.mozilla.org/en-US/security/advisories/mfsa2009-70/
https://www.mozilla.org/en-US/security/advisories/mfsa2009-71/
Plugin Details
Severity: High
ID: 43174
File Name: mozilla_firefox_356.nasl
Version: 1.15
Type: local
Agent: windows
Family: Windows
Published: 12/16/2009
Updated: 7/16/2018
Dependencies: mozilla_org_installed.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:mozilla:firefox
Required KB Items: Mozilla/Firefox/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 12/15/2009
Vulnerability Publication Date: 12/15/2009
Reference Information
CVE: CVE-2009-3388, CVE-2009-3389, CVE-2009-3979, CVE-2009-3980, CVE-2009-3982, CVE-2009-3983, CVE-2009-3984, CVE-2009-3985, CVE-2009-3986, CVE-2009-3987
BID: 37360, 37361, 37362, 37363, 37364, 37365, 37366, 37367, 37368, 37369, 37370