Mozilla Foundation Security Advisory 2010-61

2010-09-10T00:00:00
ID SECURITYVULNS:DOC:24695
Type securityvulns
Reporter Securityvulns
Modified 2010-09-10T00:00:00

Description

Mozilla Foundation Security Advisory 2010-61

Title: UTF-7 XSS by overriding document charset using <object> type attribute Impact: High Announced: September 7, 2010 Reporter: David Huang, Collin Jackson Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.9 Firefox 3.5.12 Thunderbird 3.1.3 Thunderbird 3.0.7 SeaMonkey 2.0.7 Description

Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab (Silicon Valley campus) reported that the type attribute of an <object> tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing such an <object> tag which sets the charset of the framed document to UTF-7. This could potentially allow an attacker to inject UTF-7 encoded JavaScript into a site, bypassing the site's XSS filters, and then executing the code using the above technique. References

* https://bugzilla.mozilla.org/show_bug.cgi?id=579744
* CVE-2010-2768