ID CVE-2004-1449
Summary Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7 allows remote attackers to determine the location of files on a user's hard drive by obscuring a file upload control and tricking the user into dragging text into that control.
References
Vulnerable Configurations
  • cpe:2.3:a:firebirdsql:firebird:0.7
    cpe:2.3:a:firebirdsql:firebird:0.7
  • Mozilla Mozilla Browser 0.8
    cpe:2.3:a:mozilla:mozilla:0.8
  • Mozilla Mozilla Browser 0.9.2
    cpe:2.3:a:mozilla:mozilla:0.9.2
  • Mozilla Mozilla Browser 0.9.2.1
    cpe:2.3:a:mozilla:mozilla:0.9.2.1
  • Mozilla Mozilla Browser 0.9.3
    cpe:2.3:a:mozilla:mozilla:0.9.3
  • Mozilla Mozilla Browser 0.9.35
    cpe:2.3:a:mozilla:mozilla:0.9.35
  • Mozilla Mozilla Browser 0.9.4
    cpe:2.3:a:mozilla:mozilla:0.9.4
  • Mozilla Mozilla Browser 0.9.4.1
    cpe:2.3:a:mozilla:mozilla:0.9.4.1
  • Mozilla Mozilla Browser 0.9.48
    cpe:2.3:a:mozilla:mozilla:0.9.48
  • Mozilla Mozilla Browser 0.9.5
    cpe:2.3:a:mozilla:mozilla:0.9.5
  • Mozilla Mozilla Browser 0.9.6
    cpe:2.3:a:mozilla:mozilla:0.9.6
  • Mozilla Mozilla 0.9.7
    cpe:2.3:a:mozilla:mozilla:0.9.7
  • Mozilla Mozilla Browser 0.9.8
    cpe:2.3:a:mozilla:mozilla:0.9.8
  • Mozilla Mozilla 0.9.9
    cpe:2.3:a:mozilla:mozilla:0.9.9
  • Mozilla Mozilla 1.0
    cpe:2.3:a:mozilla:mozilla:1.0
  • Mozilla Mozilla Browser 1.0.1
    cpe:2.3:a:mozilla:mozilla:1.0.1
  • Mozilla Mozilla Browser 1.0.2
    cpe:2.3:a:mozilla:mozilla:1.0.2
  • cpe:2.3:a:mozilla:mozilla:1.0:rc1
    cpe:2.3:a:mozilla:mozilla:1.0:rc1
  • cpe:2.3:a:mozilla:mozilla:1.0:rc2
    cpe:2.3:a:mozilla:mozilla:1.0:rc2
  • Mozilla Mozilla 1.1
    cpe:2.3:a:mozilla:mozilla:1.1
  • Mozilla Mozilla Browser 1.1 Alpha
    cpe:2.3:a:mozilla:mozilla:1.1:alpha
  • Mozilla Mozilla Browser 1.1 Beta
    cpe:2.3:a:mozilla:mozilla:1.1:beta
  • Mozilla Mozilla 1.2
    cpe:2.3:a:mozilla:mozilla:1.2
  • Mozilla Mozilla Browser 1.2.1
    cpe:2.3:a:mozilla:mozilla:1.2.1
  • Mozilla Mozilla Browser 1.2 Alpha
    cpe:2.3:a:mozilla:mozilla:1.2:alpha
  • Mozilla Mozilla Browser 1.2 Beta
    cpe:2.3:a:mozilla:mozilla:1.2:beta
  • Mozilla Mozilla 1.3
    cpe:2.3:a:mozilla:mozilla:1.3
  • Mozilla Mozilla Browser 1.3.1
    cpe:2.3:a:mozilla:mozilla:1.3.1
  • Mozilla Mozilla 1.4
    cpe:2.3:a:mozilla:mozilla:1.4
  • Mozilla Mozilla 1.4.1
    cpe:2.3:a:mozilla:mozilla:1.4.1
  • Mozilla Mozilla Browser 1.4.2
    cpe:2.3:a:mozilla:mozilla:1.4.2
  • Mozilla Mozilla Browser 1.4.4
    cpe:2.3:a:mozilla:mozilla:1.4.4
  • Mozilla Mozilla 1.4a
    cpe:2.3:a:mozilla:mozilla:1.4:alpha
  • Mozilla Mozilla Browser 1.4b
    cpe:2.3:a:mozilla:mozilla:1.4:beta
  • Mozilla Mozilla 1.5
    cpe:2.3:a:mozilla:mozilla:1.5
  • Mozilla Mozilla 1.5.1
    cpe:2.3:a:mozilla:mozilla:1.5.1
  • Mozilla Mozilla 1.6
    cpe:2.3:a:mozilla:mozilla:1.6
  • Mozilla Thunderbird 0.1
    cpe:2.3:a:mozilla:thunderbird:0.1
  • Mozilla Thunderbird 0.2
    cpe:2.3:a:mozilla:thunderbird:0.2
  • Mozilla Thunderbird 0.3
    cpe:2.3:a:mozilla:thunderbird:0.3
  • Mozilla Thunderbird 0.4
    cpe:2.3:a:mozilla:thunderbird:0.4
  • Mozilla Thunderbird 0.5
    cpe:2.3:a:mozilla:thunderbird:0.5
  • Mozilla Thunderbird 0.6
    cpe:2.3:a:mozilla:thunderbird:0.6
CVSS
Base: 2.6 (as of 27-06-2005 - 21:12)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
NASL family Mandriva Local Security Checks
NASL id MANDRAKE_MDKSA-2004-082.NASL
description A number of security vulnerabilities in mozilla are addressed by this update for Mandrakelinux 10.0 users, including a fix for frame spoofing, a fixed popup XPInstall/security dialog bug, a fix for untrusted chrome calls, a fix for SSL certificate spoofing, a fix for stealing secure HTTP Auth passwords via DNS spoofing, a fix for insecure matching of cert names for non-FQDNs, a fix for focus redefinition from another domain, a fix for a SOAP parameter overflow, a fix for text drag on file entry, a fix for certificate DoS, and a fix for lock icon and cert spoofing. Additionally, mozilla for both Mandrakelinux 9.2 and 10.0 have been rebuilt to use the system libjpeg and libpng which addresses vulnerabilities discovered in libpng (ref: MDKSA-2004:079).
last seen 2019-02-21
modified 2018-11-15
plugin id 14331
published 2004-08-22
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=14331
title Mandrake Linux Security Advisory : mozilla (MDKSA-2004:082)
refmap via4
confirm http://bugzilla.mozilla.org/show_bug.cgi?id=206859#c0
mandrake MDKSA-2004:082
Last major update 05-09-2008 - 16:41
Published 31-12-2004 - 00:00
Back to Top