Mozilla-based products fail to validate user input to the attribute name in "XULDocument.persist"

Overview

A vulnerability in some Mozilla products that could allow a remote attacker to execute Javascript commands with the permissions of the user running the affected application.

Description

According to the Mozilla advisory on this issue:

XULDocument.persist() did not validate the attribute name, allowing an attacker to inject XML into localstore.rdf that would be read and acted upon at startup. This could include JavaScript commands that would be run with the permissions of the browser.

Note: Thunderbird could be vulnerable if JavaScript is enabled. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration.

This vulnerability affects Mozilla Firefox, SeaMonkey, Thunderbird, and potentially any other Mozilla-based application. The exploit code for this vulnerability could be remotely supplied through a web page or in an email message.

---

Impact

A remote attacker may be able to inject XML code, including JavaScript commands, into a startup file on the victim’s system. This file would then be read and executed the next time the affected application is started.

---

Solution

Upgrade

Mozilla has released Firefox version 1.5.0.1 that contains a fix for this issue. The SeaMonkey project has released version 1.0 that contains a fix for this issue. Users are strongly encouraged to upgrade to these fixed versions of the software.

---

Vendor Information

592425

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Fedora Project __ Affected

Updated: February 03, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Fedora Project has release Fedora Security Update Notifications FEDORA-2006-075 and FEDORA-2006-076 in response to this issue. Users are encouraged to review these notifications and apply the updates they refer to, as appropriate.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23592425 Feedback>).

Mandriva, Inc. __ Affected

Updated: February 08, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The Mandriva security team has published Mandriva Linux Security Advisories MDKSA-2006:036 and MDKSA-2006:037 in response to this issue. Users are encouraged to review these advisories and apply the patches they refer to, as appropriate.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23592425 Feedback>).

Red Hat, Inc. __ Affected

Updated: February 08, 2006

Status

Affected

Vendor Statement

Updated Mozilla and Firefox packages for Red Hat Enterprise Linux 2.1, 3,

and 4 to correct this issue are available at the URL below and by using
the Red Hat Network ‘up2date’ tool.

<https://rhn.redhat.com/cve/CVE-2006-0296.html&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Red Hat, Inc. has published Red Hat Security Advisories RHSA-2006:0199 and RHSA-2006:0200 in response to this issue. Users are encouraged to review these advisories and apply the patches they refer to, as appropriate

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23592425 Feedback>).

Mozilla, Inc. Unknown

Notified: February 07, 2006 Updated: February 07, 2006

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.mozilla.org/security/announce/mfsa2006-05.html&gt;
• <https://rhn.redhat.com/errata/RHSA-2006-0199.html&gt;
• <https://rhn.redhat.com/errata/RHSA-2006-0200.html&gt;
• FEDORA-2006-075
• FEDORA-2006-076
• <http://www.securityfocus.com/bid/16476&gt;
• <http://secunia.com/advisories/18700&gt;
• <http://secunia.com/advisories/18703&gt;
• <http://secunia.com/advisories/18704&gt;
• <http://www.auscert.org.au/6000&gt;
• <http://www.auscert.org.au/6001&gt;

Acknowledgements

Thanks to the Mozilla Corporation for reporting this vulnerability. Mozilla, in turn, credits moz_bug_r_a4 with reporting this issue to them.

This document was written by Chad R Dougherty.

Other Information

CVE IDs:	CVE-2006-0296
Severity Metric:	17.10 Date Public: