ID |
CVE-2006-1726
|
Summary |
Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method. |
References |
|
Vulnerable Configurations |
-
Mozilla Firefox 1.0
cpe:2.3:a:mozilla:firefox:1.0
-
Mozilla Firefox 1.0.1
cpe:2.3:a:mozilla:firefox:1.0.1
-
Mozilla Firefox 1.0.2
cpe:2.3:a:mozilla:firefox:1.0.2
-
Mozilla Firefox 1.0.3
cpe:2.3:a:mozilla:firefox:1.0.3
-
Mozilla Firefox 1.0.4
cpe:2.3:a:mozilla:firefox:1.0.4
-
Mozilla Firefox 1.0.5
cpe:2.3:a:mozilla:firefox:1.0.5
-
Mozilla Firefox 1.0.6
cpe:2.3:a:mozilla:firefox:1.0.6
-
Mozilla Firefox 1.0.7
cpe:2.3:a:mozilla:firefox:1.0.7
-
Mozilla Firefox 1.5
cpe:2.3:a:mozilla:firefox:1.5
-
Mozilla Firefox 1.5 Beta 1
cpe:2.3:a:mozilla:firefox:1.5:beta1
-
Mozilla Firefox 1.5 Beta 2
cpe:2.3:a:mozilla:firefox:1.5:beta2
-
Mozilla Firefox 1.5.0.1
cpe:2.3:a:mozilla:firefox:1.5.0.1
-
cpe:2.3:a:mozilla:firefox:preview_release
cpe:2.3:a:mozilla:firefox:preview_release
-
cpe:2.3:a:mozilla:seamonkey:1.0:-:alpha
cpe:2.3:a:mozilla:seamonkey:1.0:-:alpha
-
Mozilla SeaMonkey 1.0 beta
cpe:2.3:a:mozilla:seamonkey:1.0:beta
-
Mozilla Thunderbird 1.0
cpe:2.3:a:mozilla:thunderbird:1.0
-
Mozilla Thunderbird 1.0.1
cpe:2.3:a:mozilla:thunderbird:1.0.1
-
Mozilla Thunderbird 1.0.2
cpe:2.3:a:mozilla:thunderbird:1.0.2
-
Mozilla Thunderbird 1.0.3
cpe:2.3:a:mozilla:thunderbird:1.0.3
-
Mozilla Thunderbird 1.0.4
cpe:2.3:a:mozilla:thunderbird:1.0.4
-
Mozilla Thunderbird 1.0.5
cpe:2.3:a:mozilla:thunderbird:1.0.5
-
Mozilla Thunderbird 1.0.5 Beta
cpe:2.3:a:mozilla:thunderbird:1.0.5:beta
-
Mozilla Thunderbird 1.0.6
cpe:2.3:a:mozilla:thunderbird:1.0.6
-
Mozilla Thunderbird 1.0.7
cpe:2.3:a:mozilla:thunderbird:1.0.7
-
Mozilla Thunderbird 1.5
cpe:2.3:a:mozilla:thunderbird:1.5
-
Mozilla Thunderbird 1.5 Beta 2
cpe:2.3:a:mozilla:thunderbird:1.5:beta2
|
CVSS |
Base: | 9.3 (as of 14-04-2006 - 10:39) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-264 |
CAPEC |
-
Accessing, Modifying or Executing Executable Files
An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
-
Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/)
http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here
The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process.
The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality.
The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
-
Blue Boxing
This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
-
Restful Privilege Elevation
Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side.
The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
-
Target Programs with Elevated Privileges
This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
-
Manipulating Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
|
Access |
Vector | Complexity | Authentication |
NETWORK |
MEDIUM |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
COMPLETE |
COMPLETE |
COMPLETE |
|
nessus
via4
|
NASL family | Solaris Local Security Checks | NASL id | SOLARIS8_120671.NASL | description | Mozilla 1.7 for Solaris 8 and 9.
Date this patch was last updated by Sun : Aug/29/08 | last seen | 2018-09-01 | modified | 2016-12-09 | plugin id | 24395 | published | 2007-02-18 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=24395 | title | Solaris 8 (sparc) : 120671-08 |
NASL family | Windows | NASL id | MOZILLA_FIREFOX_1502.NASL | description | The remote Windows host is using Firefox, an alternative web browser.
The installed version of Firefox contains various security issues,
some of which may lead to execution of arbitrary code on the affected
host subject to the user's privileges. | last seen | 2019-01-16 | modified | 2018-07-16 | plugin id | 21225 | published | 2006-04-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21225 | title | Firefox < 1.5.0.2 Multiple Vulnerabilities |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS10_X86_119116.NASL | description | Mozilla 1.7_x86 patch.
Date this patch was last updated by Sun : Aug/05/09
This plugin has been deprecated and either replaced with individual
119116 patch-revision plugins, or deemed non-security related. | last seen | 2019-01-16 | modified | 2018-07-30 | plugin id | 22987 | published | 2006-11-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22987 | title | Solaris 10 (x86) : 119116-35 (deprecated) |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS10_119115.NASL | description | Mozilla 1.7 patch.
Date this patch was last updated by Sun : Sep/13/14
This plugin has been deprecated and either replaced with individual
119115 patch-revision plugins, or deemed non-security related. | last seen | 2019-01-16 | modified | 2018-07-30 | plugin id | 22954 | published | 2006-11-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22954 | title | Solaris 10 (sparc) : 119115-36 (deprecated) |
NASL family | Debian Local Security Checks | NASL id | DEBIAN_DSA-1046.NASL | description | Several security related problems have been discovered in Mozilla. The
Common Vulnerabilities and Exposures project identifies the following
vulnerabilities :
- CVE-2005-2353
The 'run-mozilla.sh' script allows local users to create
or overwrite arbitrary files when debugging is enabled
via a symlink attack on temporary files.
- CVE-2005-4134
Web pages with extremely long titles cause subsequent
launches of the browser to appear to 'hang' for up to a
few minutes, or even crash if the computer has
insufficient memory. [MFSA-2006-03]
- CVE-2006-0292
The JavaScript interpreter does not properly dereference
objects, which allows remote attackers to cause a denial
of service or execute arbitrary code. [MFSA-2006-01]
- CVE-2006-0293
The function allocation code allows attackers to cause a
denial of service and possibly execute arbitrary code.
[MFSA-2006-01]
- CVE-2006-0296
XULDocument.persist() did not validate the attribute
name, allowing an attacker to inject arbitrary XML and
JavaScript code into localstore.rdf that would be read
and acted upon during startup. [MFSA-2006-05]
- CVE-2006-0748
An anonymous researcher for TippingPoint and the Zero
Day Initiative reported that an invalid and nonsensical
ordering of table-related tags can be exploited to
execute arbitrary code. [MFSA-2006-27]
- CVE-2006-0749
A particular sequence of HTML tags can cause memory
corruption that can be exploited to execute arbitrary
code. [MFSA-2006-18]
- CVE-2006-0884
Georgi Guninski reports that forwarding mail in-line
while using the default HTML 'rich mail' editor will
execute JavaScript embedded in the e-mail message with
full privileges of the client. [MFSA-2006-21]
- CVE-2006-1045
The HTML rendering engine does not properly block
external images from inline HTML attachments when 'Block
loading of remote images in mail messages' is enabled,
which could allow remote attackers to obtain sensitive
information. [MFSA-2006-26]
- CVE-2006-1529
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1530
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1531
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1723
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1724
A vulnerability potentially allows remote attackers to
cause a denial of service and possibly execute arbitrary
code. [MFSA-2006-20]
- CVE-2006-1725
Due to an interaction between XUL content windows and
the history mechanism, some windows may to become
translucent, which might allow remote attackers to
execute arbitrary code. [MFSA-2006-29]
- CVE-2006-1726
'shutdown' discovered that the security check of the
function js_ValueToFunctionObject() can be circumvented
and exploited to allow the installation of malware.
[MFSA-2006-28]
- CVE-2006-1727
Georgi Guninski reported two variants of using scripts
in an XBL control to gain chrome privileges when the
page is viewed under 'Print Preview'. [MFSA-2006-25]
- CVE-2006-1728
'shutdown' discovered that the
crypto.generateCRMFRequest method can be used to run
arbitrary code with the privilege of the user running
the browser, which could enable an attacker to install
malware. [MFSA-2006-24]
- CVE-2006-1729
Claus Jorgensen reported that a text input box can be
pre-filled with a filename and then turned into a
file-upload control, allowing a malicious website to
steal any local file whose name they can guess.
[MFSA-2006-23]
- CVE-2006-1730
An anonymous researcher for TippingPoint and the Zero
Day Initiative discovered an integer overflow triggered
by the CSS letter-spacing property, which could be
exploited to execute arbitrary code. [MFSA-2006-22]
- CVE-2006-1731
'moz_bug_r_a4' discovered that some internal functions
return prototypes instead of objects, which allows
remote attackers to conduct cross-site scripting
attacks. [MFSA-2006-19]
- CVE-2006-1732
'shutdown' discovered that it is possible to bypass
same-origin protections, allowing a malicious site to
inject script into content from another site, which
could allow the malicious page to steal information such
as cookies or passwords from the other site, or perform
transactions on the user's behalf if the user were
already logged in. [MFSA-2006-17]
- CVE-2006-1733
'moz_bug_r_a4' discovered that the compilation scope of
privileged built-in XBL bindings is not fully protected
from web content and can still be executed which could
be used to execute arbitrary JavaScript, which could
allow an attacker to install malware such as viruses and
password sniffers. [MFSA-2006-16]
- CVE-2006-1734
'shutdown' discovered that it is possible to access an
internal function object which could then be used to run
arbitrary JavaScript code with full permissions of the
user running the browser, which could be used to install
spyware or viruses. [MFSA-2006-15]
- CVE-2006-1735
It is possible to create JavaScript functions that would
get compiled with the wrong privileges, allowing an
attacker to run code of their choice with full
permissions of the user running the browser, which could
be used to install spyware or viruses. [MFSA-2006-14]
- CVE-2006-1736
It is possible to trick users into downloading and
saving an executable file via an image that is overlaid
by a transparent image link that points to the
executable. [MFSA-2006-13]
- CVE-2006-1737
An integer overflow allows remote attackers to cause a
denial of service and possibly execute arbitrary
bytecode via JavaScript with a large regular expression.
[MFSA-2006-11]
- CVE-2006-1738
An unspecified vulnerability allows remote attackers to
cause a denial of service. [MFSA-2006-11]
- CVE-2006-1739
Certain Cascading Style Sheets (CSS) can cause an
out-of-bounds array write and buffer overflow that could
lead to a denial of service and the possible execution
of arbitrary code. [MFSA-2006-11]
- CVE-2006-1740
It is possible for remote attackers to spoof secure site
indicators such as the locked icon by opening the
trusted site in a popup window, then changing the
location to a malicious site. [MFSA-2006-12]
- CVE-2006-1741
'shutdown' discovered that it is possible to inject
arbitrary JavaScript code into a page on another site
using a modal alert to suspend an event handler while a
new page is being loaded. This could be used to steal
confidential information. [MFSA-2006-09]
- CVE-2006-1742
Igor Bukanov discovered that the JavaScript engine does
not properly handle temporary variables, which might
allow remote attackers to trigger operations on freed
memory and cause memory corruption. [MFSA-2006-10]
- CVE-2006-1790
A regression fix that could lead to memory corruption
allows remote attackers to cause a denial of service and
possibly execute arbitrary code. [MFSA-2006-11] | last seen | 2019-01-16 | modified | 2018-07-20 | plugin id | 22588 | published | 2006-10-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=22588 | title | Debian DSA-1046-1 : mozilla - several vulnerabilities |
NASL family | Windows | NASL id | SEAMONKEY_101.NASL | description | The remote Windows host is using SeaMonkey, an alternative web browser
and application suite.
The installed version of SeaMonkey contains various security issues,
some of which may lead to execution of arbitrary code on the affected
host subject to the user's privileges. | last seen | 2019-01-16 | modified | 2018-07-27 | plugin id | 21226 | published | 2006-04-14 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21226 | title | SeaMonkey < 1.0.1 Multiple Vulnerabilities |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS9_120671.NASL | description | Mozilla 1.7 for Solaris 8 and 9.
Date this patch was last updated by Sun : Aug/29/08 | last seen | 2018-09-01 | modified | 2016-12-09 | plugin id | 24403 | published | 2007-02-18 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=24403 | title | Solaris 9 (sparc) : 120671-08 |
NASL family | FreeBSD Local Security Checks | NASL id | FREEBSD_PKG_84630F4ACD8C11DAB7B9000C6EC775D9.NASL | description | A Mozilla Foundation Security Advisory reports of multiple issues.
Several of which can be used to run arbitrary code with the privilege
of the user running the program.
- MFSA 2006-29 Spoofing with translucent windows
- MFSA 2006-28 Security check of js_ValueToFunctionObject() can be
circumvented
- MFSA 2006-26 Mail Multiple Information Disclosure
- MFSA 2006-25 Privilege escalation through Print Preview
- MFSA 2006-24 Privilege escalation using crypto.generateCRMFRequest
- MFSA 2006-23 File stealing by changing input type
- MFSA 2006-22 CSS Letter-Spacing Heap Overflow Vulnerability
- MFSA 2006-20 Crashes with evidence of memory corruption (rv:1.8.0.2)
- MFSA 2006-19 Cross-site scripting using .valueOf.call()
- MFSA 2006-18 Mozilla Firefox Tag Order Vulnerability
- MFSA 2006-17 cross-site scripting through window.controllers
- MFSA 2006-16 Accessing XBL compilation scope via valueOf.call()
- MFSA 2006-15 Privilege escalation using a JavaScript function's
cloned parent
- MFSA 2006-14 Privilege escalation via XBL.method.eval
- MFSA 2006-13 Downloading executables with 'Save Image As...'
- MFSA 2006-12 Secure-site spoof (requires security warning dialog)
- MFSA 2006-11 Crashes with evidence of memory corruption (rv:1.8)
- MFSA 2006-10 JavaScript garbage-collection hazard audit
- MFSA 2006-09 Cross-site JavaScript injection using event handlers | last seen | 2019-01-16 | modified | 2018-12-19 | plugin id | 21461 | published | 2006-05-13 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=21461 | title | FreeBSD : mozilla -- multiple vulnerabilities (84630f4a-cd8c-11da-b7b9-000c6ec775d9) |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS8_X86_120672.NASL | description | Mozilla 1.7_x86 for Solaris 8 and 9.
Date this patch was last updated by Sun : Sep/02/08 | last seen | 2018-09-02 | modified | 2016-12-09 | plugin id | 23772 | published | 2006-12-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=23772 | title | Solaris 8 (x86) : 120672-08 |
NASL family | Solaris Local Security Checks | NASL id | SOLARIS9_X86_120672.NASL | description | Mozilla 1.7_x86 for Solaris 8 and 9.
Date this patch was last updated by Sun : Sep/02/08 | last seen | 2018-09-01 | modified | 2016-12-09 | plugin id | 23773 | published | 2006-12-06 | reporter | Tenable | source | https://www.tenable.com/plugins/index.php?view=single&id=23773 | title | Solaris 9 (x86) : 120672-08 |
|
oval
via4
|
accepted | 2011-02-21T04:00:46.980-05:00 | class | vulnerability | contributors | name | Robert L. Hollis | organization | ThreatGuard, Inc. |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
name | Mike Lah | organization | The MITRE Corporation |
name | Jonathan Baker | organization | The MITRE Corporation |
| description | Unspecified vulnerability in Firefox and Thunderbird 1.5 before 1.5.0.2, and SeaMonkey before 1.0.1, allows remote attackers to bypass the js_ValueToFunctionObject check and execute arbitrary code via unknown vectors involving setTimeout and Firefox' ForEach method. | family | windows | id | oval:org.mitre.oval:def:1968 | status | accepted | submitted | 2006-05-07T09:05:00.000-04:00 | title | Mozilla Security Check of js_ValueToFunctionObject() Can Be Circumvented | version | 7 |
|
refmap
via4
|
|
Last major update |
07-03-2011 - 21:33 |
Published |
14-04-2006 - 06:02 |
Last modified |
18-10-2018 - 12:34 |