----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Mozilla Firefox 2 Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA32693

VERIFY ADVISORY:
http://secunia.com/advisories/32693/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Exposure of system information, Exposure of
sensitive information, System access

WHERE:
>From remote

SOFTWARE:
Mozilla Firefox 2.0.x
http://secunia.com/advisories/product/12434/

DESCRIPTION:
Some vulnerabilities have been reported in Mozilla Firefox, which can
be exploited by malicious people to disclose sensitive information,
bypass certain security restrictions, or compromise a user's system.

1) An error in the processing of ".url" shortcuts can be exploited to
obtain sensitive information from the local cache.

For more information:
SA32192

2) An error in the handling of HTTP redirect requests can be
exploited to bypass the same-origin policy and access sensitive
information from another domain.

3) An error exists when testing if a Flash module is dynamically
unloaded. This can be exploited to dereference memory no longer
mapped to the Flash module via an SWF file that dynamically unloads
itself from an outside JavaScript function.

4) An error when locking a non-native object can be exploited to
cause a crash via a web page assigning a specially crafted value to
the "window.__proto__.__proto__" object.

5) An error in the browser engine can be exploited to cause a memory
corruption.

6) Two errors in the JavaScript engine can be exploited to cause
memory corruptions.

Successful exploitation of vulnerabilities #3-#6 may allow execution
of arbitrary code.

7) An error in the browser's restore feature can be exploited to
violate the same-origin policy and run arbitrary JavaScript code in
the context of another site.

NOTE: The vulnerability can also be exploited to execute arbitrary
JavaScript code with chrome privileges.

8) An error in the processing of the "http-index-format" MIME type
can be exploited to execute arbitrary code via a specially crafted
200 header line included in an HTTP index response.

9) An error in the DOM constructing code can be exploited to
dereference uninitialized memory and potentially execute arbitrary
code by modifying certain properties of a file input element before
the element has finished initializing.

10) An error in the implementation of the
"nsXMLHttpRequest::NotifyEventListeners()" method can be exploited to
execute arbitrary JavaScript code in the context of another site.

11) An error when handling the "-moz-binding" CSS property can be
exploited to manipulate signed JAR files and execute arbitrary
JavaScript code in the context of another site.

12) An error exists when parsing the default XML namespace of an E4X
document. This can be exploited to inject arbitrary XML code via a
specially crafted namespace containing quote characters.

The vulnerabilities are reported in versions prior to 2.0.0.18.

SOLUTION:
Update to version 2.0.0.18.
http://www.mozilla.com/en-US/firefox/all-older.html

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Liu Die Yu of TopsecTianRongXin
2) Georgi Guninski, Michal Zalewski, and Chris Evans
3) an anonymous researcher, reported via ZDI
4) Jesse Ruderman
5) Daniel Veditz
6) Bob Clary and Joachim Kuebart
7) David Bloom and moz_bug_r_a4
8) Justin Schuh of IBM X-Force
9) ling and wushi of team509, reported via ZDI
10) moz_bug_r_a4
11) Collin Jackson
12) Chris Evans

ORIGINAL ADVISORY:
http://www.mozilla.org/security/announce/2008/mfsa2008-47.html
http://www.mozilla.org/security/announce/2008/mfsa2008-48.html
http://www.mozilla.org/security/announce/2008/mfsa2008-49.html
http://www.mozilla.org/security/announce/2008/mfsa2008-50.html
http://www.mozilla.org/security/announce/2008/mfsa2008-52.html
http://www.mozilla.org/security/announce/2008/mfsa2008-53.html
http://www.mozilla.org/security/announce/2008/mfsa2008-54.html
http://www.mozilla.org/security/announce/2008/mfsa2008-55.html
http://www.mozilla.org/security/announce/2008/mfsa2008-56.html
http://www.mozilla.org/security/announce/2008/mfsa2008-57.html
http://www.mozilla.org/security/announce/2008/mfsa2008-58.html

OTHER REFERENCES:
SA32192:
http://secunia.com/advisories/32192/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------