ID CVE-2013-1697
Summary The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
References
Vulnerable Configurations
  • Mozilla Firefox 19.0
    cpe:2.3:a:mozilla:firefox:19.0
  • Mozilla Firefox 19.0.1
    cpe:2.3:a:mozilla:firefox:19.0.1
  • Mozilla Firefox 19.0.2
    cpe:2.3:a:mozilla:firefox:19.0.2
  • Mozilla Firefox 20.0
    cpe:2.3:a:mozilla:firefox:20.0
  • Mozilla Firefox 20.0.1
    cpe:2.3:a:mozilla:firefox:20.0.1
  • Mozilla Firefox 21.0
    cpe:2.3:a:mozilla:firefox:21.0
  • Mozilla Firefox Extended Support Release (ESR) 17.0.2
    cpe:2.3:a:mozilla:firefox_esr:17.0.2
  • Mozilla Firefox Extended Support Release (ESR) 17.0.1
    cpe:2.3:a:mozilla:firefox_esr:17.0.1
  • Mozilla Firefox Extended Support Release (ESR) 17.0
    cpe:2.3:a:mozilla:firefox_esr:17.0
  • Mozilla Firefox Extended Support Release (ESR) 17.0.3
    cpe:2.3:a:mozilla:firefox_esr:17.0.3
  • Mozilla Firefox Extended Support Release (ESR) 17.0.4
    cpe:2.3:a:mozilla:firefox_esr:17.0.4
  • Mozilla Firefox Extended Support Release (ESR) 17.0.5
    cpe:2.3:a:mozilla:firefox_esr:17.0.5
  • Mozilla Firefox Extended Support Release (ESR) 17.0.6
    cpe:2.3:a:mozilla:firefox_esr:17.0.6
  • Mozilla Thunderbird 17.0.2
    cpe:2.3:a:mozilla:thunderbird:17.0.2
  • Mozilla Thunderbird 17.0
    cpe:2.3:a:mozilla:thunderbird:17.0
  • Mozilla Thunderbird 17.0.1
    cpe:2.3:a:mozilla:thunderbird:17.0.1
  • Mozilla Thunderbird 17.0.3
    cpe:2.3:a:mozilla:thunderbird:17.0.3
  • Mozilla Thunderbird 17.0.4
    cpe:2.3:a:mozilla:thunderbird:17.0.4
  • Mozilla Thunderbird 17.0.5
    cpe:2.3:a:mozilla:thunderbird:17.0.5
  • Mozilla Thunderbird 17.0.6
    cpe:2.3:a:mozilla:thunderbird:17.0.6
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0
    cpe:2.3:a:mozilla:thunderbird_esr:17.0
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.1
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.1
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.2
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.2
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.3
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.3
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.4
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.4
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.5
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.5
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.6
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.6
CVSS
Base: 9.3 (as of 26-06-2013 - 13:45)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201309-23.NASL
    description The remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Further, a remote attacker could conduct XSS attacks, spoof URLs, bypass address space layout randomization, conduct clickjacking attacks, obtain potentially sensitive information, bypass access restrictions, modify the local filesystem, or conduct other unspecified attacks. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 70183
    published 2013-09-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70183
    title GLSA-201309-23 : Mozilla Products: Multiple vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2720.NASL
    description Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors, use-after-free vulnerabilities, missing permission checks, incorrect memory handling and other implementation errors may lead to the execution of arbitrary code, privilege escalation, information disclosure or cross-site request forgery. As already announced for Iceweasel: we're changing the approach for security updates for Icedove in stable-security: instead of backporting security fixes, we now provide releases based on the Extended Support Release branch. As such, this update introduces packages based on Thunderbird 17 and at some point in the future we will switch to the next ESR branch once ESR 17 has reached it's end of life. Some Icedove extensions currently packaged in the Debian archive are not compatible with the new browser engine. Up-to-date and compatible versions can be retrieved from http://addons.mozilla.org as a short term solution. An updated and compatible version of Enigmail is included with this update. The Icedove version in the oldstable distribution (squeeze) is no longer supported with full security updates. However, it should be noted that almost all security issues in Icedove stem from the included browser engine. These security problems only affect Icedove if scripting and HTML mails are enabled. If there are security issues specific to Icedove (e.g. a hypothetical buffer overflow in the IMAP implementation) we'll make an effort to backport such fixes to oldstable.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 67201
    published 2013-07-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67201
    title Debian DSA-2720-1 : icedove - several vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-574.NASL
    description seamonkey was updated to 2.19 (bnc#825935) to fix bugs and security issues. Security issues fixed : - MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements - MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context - MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location - MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75081
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75081
    title openSUSE Security Update : seamonkey (openSUSE-SU-2013:1180-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_FIREFOX-20130628-8636.NASL
    description Mozilla Firefox has been updated to the 17.0.7 ESR version, which fixes bugs and security fixes. - Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2013-49) Gary Kwong, Jesse Ruderman, and Andrew McCreight reported memory safety problems and crashes that affect Firefox ESR 17, and Firefox 21. (CVE-2013-1682) - Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a series of use-after-free problems rated critical as security issues in shipped software. Some of these issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting additional use-after-free and buffer overflow flaws in code introduced during Firefox development. These were fixed before general release. (MFSA 2013-50) o Heap-use-after-free in mozilla::dom::HTMLMediaElement::LookupMediaElementURITab le (CVE-2013-1684) o Heap-use-after-free in nsIDocument::GetRootElement (CVE-2013-1685) o Heap-use-after-free in mozilla::ResetDir. (CVE-2013-1686) - Security researcher Mariusz Mlynski reported that it is possible to compile a user-defined function in the XBL scope of a specific element and then trigger an event within this scope to run code. In some circumstances, when this code is run, it can access content protected by System Only Wrappers (SOW) and chrome-privileged pages. This could potentially lead to arbitrary code execution. Additionally, Chrome Object Wrappers (COW) can be bypassed by web content to access privileged methods, leading to a cross-site scripting (XSS) attack from privileged pages. (MFSA 2013-51 / CVE-2013-1687) - Security researcher Nils reported that specially crafted web content using the onreadystatechange event and reloading of pages could sometimes cause a crash when unmapped memory is executed. This crash is potentially exploitable. (MFSA 2013-53 / CVE-2013-1690) - Security researcher Johnathan Kuskos reported that Firefox is sending data in the body of XMLHttpRequest (XHR) HEAD requests, which goes against the XHR specification. This can potentially be used for Cross-Site Request Forgery (CSRF) attacks against sites which do not distinguish between HEAD and POST requests. (MFSA 2013-54 / CVE-2013-1692) - Security researcher Paul Stone of Context Information Security discovered that timing differences in the processing of SVG format images with filters could allow for pixel values to be read. This could potentially allow for text values to be read across domains, leading to information disclosure. (MFSA 2013-55 / CVE-2013-1693) - Mozilla security researcher moz_bug_r_a4 reported that XrayWrappers can be bypassed to call content-defined toString and valueOf methods through DefaultValue. This can lead to unexpected behavior when privileged code acts on the incorrect values. (MFSA 2013-59 / CVE-2013-1697)
    last seen 2019-02-21
    modified 2014-10-28
    plugin id 67198
    published 2013-07-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67198
    title SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8636)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-556.NASL
    description MozillaFirefox was updated to Firefox 22.0 (bnc#825935) Following security issues were fixed : - MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements - MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context - MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location - MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75073
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75073
    title openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1142-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1890-2.NASL
    description USN-1890-1 fixed vulnerabilities in Firefox. This update introduced a regression which sometimes resulted in Firefox using the wrong network proxy settings. This update fixes the problem. We apologize for the inconvenience. Multiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1682, CVE-2013-1683) Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) Mariusz Mlynski discovered that user defined code within the XBL scope of an element could be made to bypass System Only Wrappers (SOW). An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1687) Mariusz Mlynski discovered that the profiler user interface incorrectly handled data from the profiler. If the user examined profiler output on a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1688) A crash was discovered when reloading a page that contained content using the onreadystatechange event. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox (CVE-2013-1690) Johnathan Kuskos discovered that Firefox sent data in the body of XMLHttpRequest HEAD requests. An attacker could exploit this to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Paul Stone discovered a timing flaw in the processing of SVG images with filters. An attacker could exploit this to view sensitive information. (CVE-2013-1693) Boris Zbarsky discovered a flaw in PreserveWrapper. An attacker could potentially exploit this to cause a denial of service via application crash, or execute code with the privileges of the user invoking Firefox. (CVE-2013-1694) Bob Owen discovered that a sandboxed iframe could use a frame element to bypass its own restrictions. (CVE-2013-1695) Frederic Buclin discovered that the X-Frame-Options header is ignored in multi-part responses. An attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2013-1696) It was discovered that XrayWrappers could be bypassed to call content-defined methods in certain circumstances. An attacker could exploit this to cause undefined behaviour. (CVE-2013-1697) Matt Wobensmith discovered that the getUserMedia permission dialog displayed the wrong domain in certain circumstances. An attacker could potentially exploit this to trick the user in to giving a malicious site access to their microphone or camera. (CVE-2013-1698) It was discovered that the measures for preventing homograph attacks using Internationalized Domain Names (IDN) were not sufficient for certain Top Level Domains (TLD). An attacker could potentially exploit this to conduct URL spoofing and phishing attacks. (CVE-2013-1699). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 67186
    published 2013-07-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67186
    title Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox regression (USN-1890-2)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_B3FCB387DE4B11E2B1C60025905A4771.NASL
    description The Mozilla Project reports : Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7) Title: Memory corruption found using Address Sanitizer Privileged content access and execution via XBL Arbitrary code execution within Profiler Execution of unmapped memory through onreadystatechange Data in the body of XHR HEAD requests leads to CSRF attacks SVG filters can lead to information disclosure PreserveWrapper has inconsistent behavior Sandbox restrictions not applied to nested frame elements X-Frame-Options ignored when using server push with multi-part responses XrayWrappers can be bypassed to run user defined methods in a privileged context getUserMedia permission dialog incorrectly displays location Homograph domain spoofing in .com, .net and .name Inaccessible updater can lead to local privilege escalation
    last seen 2019-02-21
    modified 2018-11-23
    plugin id 66999
    published 2013-06-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66999
    title FreeBSD : mozilla -- multiple vulnerabilities (b3fcb387-de4b-11e2-b1c6-0025905a4771)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_17_0_7.NASL
    description The installed version of Thunderbird is earlier than 17.0.7 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to 'LookupMediaElementURITable', 'nsIDocument::GetRootElement' and 'mozilla::ResetDir'. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) - An error exists related to 'XBL scope', 'System Only Wrappers' (SOW) and chrome-privileged pages that could allow cross-site scripting attacks. (CVE-2013-1687) - An error exists related to the 'profiler' that could allow arbitrary code execution. (CVE-2013-1688) - An error related to 'onreadystatechange' and unmapped memory could cause application crashes and allow arbitrary code execution. (CVE-2013-1690) - The application sends data in the body of XMLHttpRequest (XHR) HEAD requests and could aid in cross-site request forgery attacks. (CVE-2013-1692) - An error related to the processing of SVG content could allow a timing attack to disclose information across domains. (CVE-2013-1693) - An error exists related to 'PreserveWrapper' and the 'preserved-wrapper' flag that could cause potentially exploitable application crashes. (CVE-2013-1694) - An error exists related to '