CyberInsecure.com

Mozilla Releases Firefox 2.0.0.16 With Two Security Updates

Mozilla has released Firefox 2.0.0.16 to address two vulnerabilities. Exploitation of these vulnerabilities may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. One of these vulnerabilities may also affect Thunderbird and SeaMonkey.

The vulnerabilities are:

MFSA 2008-34 : Remote code execution by overflowing CSS reference counter.

MFSA 2008-35 : Command-line URLs launch multiple tabs when Firefox not running.

If Firefox is not already running, passing it a command-line URI with pipe (”|”) symbols will open multiple tabs. This URI splitting could be used to launch chrome: URIs from the command-line, a partial bypass of the fix for MFSA 2005-53 which was intended to block external applications from loading such URIs (that vulnerability remains fixed, however).

This vulnerability could also be used by an attacker to pass URIs to Firefox that would normally be handled by a vector application by appending it to a URI not handled by the vector application. For example, web browsers normally handle file: URIs themselves, or block them from web content altogether, but this flaw enabled attackers to pass them from another browser into Firefox. In Firefox 2 scripts running from file: URIs can read data from a user’s entire disk, a risk if the attacker could first place a malicious file in a guessable location on the local disk.

Firefox 3 users can not update their browser yet but there is an unofficial 3.0.1-rc1 version which can be downloaded from Mozilla FTP.

In Firefox 3 scripts running in local files have limited access to other files, almost entirely mitigating the file: attack. However, combined with a vulnerability which allows an attacker to inject script into a chrome document the above issue could be used to run arbitrary code on a victim’s computer. Such a chrome injection vulnerability was discovered in Firefox 3 by Mozilla developers Ben Turner and Dan Veditz who showed that a XUL based error page was not properly sanitizing inputs and could be used in this attack.

Users should review Mozilla Foundation security advisories and upgrade to a fixed version or implement the workarounds listed in the documents to help mitigate the risks.

Update: Actually there are three updates, not two:

MFSA 2008-36: Crash with malformed GIF file on Mac OS X. Where a specially crafted GIF file caused the browser to free an uninitialized pointer. This can crash the browser and allow arbitrary code execution on the victim’s computer.

Posted in Software, Vulnerabilities |  Print This Post