[Full-disclosure] MDKSA-2005:128 - Updated mozilla packages fix multiple vulnerabilities

From: Mandriva Security Team (security_at_mandriva.com)
Date: 08/03/05

  • Next message: Thierry Zoller: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation" 
    To: full-disclosure@lists.grok.org.uk
Date: Wed, 03 Aug 2005 00:43:37 -0600

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

     _______________________________________________________________________

                    Mandriva Linux Security Update Advisory
     _______________________________________________________________________

     Package name: mozilla
     Advisory ID: MDKSA-2005:128
     Date: August 2nd, 2005

     Affected versions: 10.1, Corporate 3.0
     ______________________________________________________________________

     Problem Description:

     A number of vulnerabilities were reported and fixed in Mozilla 1.7.9.
     The following vulnerabilities have been backported and patched for
     this update:
     
     In several places the browser UI did not correctly distinguish between
     true user events, such as mouse clicks or keystrokes, and synthetic
     events genenerated by web content. The problems ranged from minor
     annoyances like switching tabs or entering full-screen mode, to a
     variant on MFSA 2005-34 Synthetic events are now prevented from
     reaching the browser UI entirely rather than depend on each potentially
     spoofed function to protect itself from untrusted events
     (MFSA 2005-45).
     
     Scripts in XBL controls from web content continued to be run even when
     Javascript was disabled. By itself this causes no harm, but it could be
     combined with most script-based exploits to attack people running
     vulnerable versions who thought disabling javascript would protect
     them. In the Thunderbird and Mozilla Suite mail clients Javascript is
     disabled by default for protection against denial-of-service attacks
     and worms; this vulnerability could be used to bypass that protection
     (MFSA 2005-46).
     
     The InstallTrigger.install() method for launching an install accepts a
     callback function that will be called with the final success or error
     status. By forcing a page navigation immediately after calling the
     install method this callback function can end up running in the context
     of the new page selected by the attacker. This is true even if the user
     cancels the unwanted install dialog: cancel is an error status. This
     callback script can steal data from the new page such as cookies or
     passwords, or perform actions on the user's behalf such as make a
     purchase if the user is already logged into the target site. In
     Firefox the default settings allow only http://addons.mozilla.org to
     bring up this install dialog. This could only be exploited if users
     have added questionable sites to the install whitelist, and if a
     malicious site can convince you to install from their site that's a
     much more powerful attack vector. In the Mozilla Suite the whitelist
     feature is turned off by default, any site can prompt the user to
     install software and exploit this vulnerability. The browser has been
     fixed to clear any pending callback function when switching to a new
     site (MFSA 2005-48).
     
     When InstallVersion.compareTo() is passed an object rather than a
     string it assumed the object was another InstallVersion without
     verifying it. When passed a different kind of object the browser would
     generally crash with an access violation. shutdown has demonstrated
     that different javascript objects can be passed on some OS versions to
     get control over the instruction pointer. We assume this could be
     developed further to run arbitrary machine code if the attacker can get
     exploit code loaded at a predictable address (MFSA 2005-50).
     
     The original frame-injection spoofing bug was fixed in the Mozilla
     Suite 1.7 and Firefox 0.9 releases. This protection was accidentally
     bypassed by one of the fixes in the Firefox 1.0.3 and Mozilla Suite
     1.7.7 releases (MFSA 2005-51).
     
     A child frame can call top.focus() even if the framing page comes from
     a different origin and has overridden the focus() routine. The call is
     made in the context of the child frame. The attacker would look for a
     target site with a framed page that makes this call but doesn't verify
     that its parent comes from the same site. The attacker could steal
     cookies and passwords from the framed page, or take actions on behalf
     of a signed-in user. This attack would work only against sites that use
     frames in this manner (MFSA 2005-52).
     
     Alerts and prompts created by scripts in web pages are presented with
     the generic title [JavaScript Application] which sometimes makes it
     difficult to know which site created them. A malicious page could
     attempt to cause a prompt to appear in front of a trusted site in an
     attempt to extract information such as passwords from the user. In the
     fixed version these prompts will contain the hostname from the page
     which created it (MFSA 2005-54).
     
     Parts of the browser UI relied too much on DOM node names without
     taking different namespaces into account and verifying that nodes
     really were of the expected type. An XHTML document could be used to
     create fake <IMG> elements, for example, with content-defined
     properties that the browser would access as if they were the trusted
     built-in properties of the expected HTML elements. The severity of the
     vulnerability would depend on what the attacker could convince the
     victim to do, but could result in executing user-supplied script with
     elevated "chrome" privileges. This could be used to install malicious
     software on the victim's machine (MFSA 2005-55).
     
     Improper cloning of base objects allowed web content scripts to walk up
     the prototype chain to get to a privileged object. This could be used
     to execute code with enhanced privileges (MFSA 2005-56).
     
     The updated packages have been patched to address these issue. This
     update also brings the mozilla shipped in Mandriva Linux 10.1 to
     version 1.7.8 to ease maintenance. As a result, new galeon and
     epiphany packages are also available for 10.1, and community contribs
     packages that are built against mozilla have been rebuilt and are
     also available via contribs.
     _______________________________________________________________________

     References:

      http://www.mozilla.org/security/announce/mfsa2005-45.html
      http://www.mozilla.org/security/announce/mfsa2005-46.html
      http://www.mozilla.org/security/announce/mfsa2005-48.html
      http://www.mozilla.org/security/announce/mfsa2005-50.html
      http://www.mozilla.org/security/announce/mfsa2005-51.html
      http://www.mozilla.org/security/announce/mfsa2005-52.html
      http://www.mozilla.org/security/announce/mfsa2005-54.html
      http://www.mozilla.org/security/announce/mfsa2005-55.html
      http://www.mozilla.org/security/announce/mfsa2005-56.html
      http://secunia.com/advisories/15489/
      http://secunia.com/advisories/15549/
      http://secunia.com/advisories/15601/
     ______________________________________________________________________

     Updated Packages:
      
     Mandrakelinux 10.1:
     b1ed603e1d571bf55b35dcf3934715f0 10.1/RPMS/epiphany-1.2.8-4.3.101mdk.i586.rpm
     1b7a293fd2ad206ccbc8774c439c0a4f 10.1/RPMS/epiphany-devel-1.2.8-4.3.101mdk.i586.rpm
     b749ecba69520e77411144fb1019acd3 10.1/RPMS/galeon-1.3.17-3.3.101mdk.i586.rpm
     0f50b3f9e0c34be38517114f488da47e 10.1/RPMS/libnspr4-1.7.8-0.2.101mdk.i586.rpm
     c7e2ffd0049ee31f24462406990521be 10.1/RPMS/libnspr4-devel-1.7.8-0.2.101mdk.i586.rpm
     5afe6299791f9b02ebe9ca50ad5af4f2 10.1/RPMS/libnss3-1.7.8-0.2.101mdk.i586.rpm
     08dacfc4d6041f0ad91effb7620bfbb4 10.1/RPMS/libnss3-devel-1.7.8-0.2.101mdk.i586.rpm
     b13923d572288eaf34db5ce21f84ca8a 10.1/RPMS/mozilla-1.7.8-0.2.101mdk.i586.rpm
     f9434ca544adf8c81b5269206323e49d 10.1/RPMS/mozilla-devel-1.7.8-0.2.101mdk.i586.rpm
     bb6fa6a7a6320a494f7406c97d56e18b 10.1/RPMS/mozilla-dom-inspector-1.7.8-0.2.101mdk.i586.rpm
     a3f4980a03dba6247483413402605e1f 10.1/RPMS/mozilla-enigmail-1.7.8-0.2.101mdk.i586.rpm
     94d9b3e19fe4386918dba744691d5e23 10.1/RPMS/mozilla-enigmime-1.7.8-0.2.101mdk.i586.rpm
     904c348ecbee1bf452de597df8f59062 10.1/RPMS/mozilla-irc-1.7.8-0.2.101mdk.i586.rpm
     ff0ca565c69e6773fd83d8b7cc625245 10.1/RPMS/mozilla-js-debugger-1.7.8-0.2.101mdk.i586.rpm
     2a6f2bb208251f8d47697eb25e856d02 10.1/RPMS/mozilla-mail-1.7.8-0.2.101mdk.i586.rpm
     cdd099b62c2b2144ac9c9f129f1256f1 10.1/RPMS/mozilla-spellchecker-1.7.8-0.2.101mdk.i586.rpm
     b7f5fe1866b17d72281aacefce238eab 10.1/SRPMS/epiphany-1.2.8-4.3.101mdk.src.rpm
     8464ea621f75482c3a08fedb00729767 10.1/SRPMS/galeon-1.3.17-3.3.101mdk.src.rpm
     9c8dea4d7f4b532329afb3cc945c654b 10.1/SRPMS/mozilla-1.7.8-0.2.101mdk.src.rpm

     Mandrakelinux 10.1/X86_64:
     66b5ba7351c0dde849b78fb41720f7b3 x86_64/10.1/RPMS/epiphany-1.2.8-4.3.101mdk.x86_64.rpm
     8d6f0504e88642e71104aa38dfdb801d x86_64/10.1/RPMS/epiphany-devel-1.2.8-4.3.101mdk.x86_64.rpm
     9ed6595f414b7595c3e8c6b5c70fc8cd x86_64/10.1/RPMS/galeon-1.3.17-3.3.101mdk.x86_64.rpm
     e781ff913b57bb5f1becce7934d03691 x86_64/10.1/RPMS/lib64nspr4-1.7.8-0.2.101mdk.x86_64.rpm
     26c709082cb2a8dfc62603a5ee4226bc x86_64/10.1/RPMS/lib64nspr4-devel-1.7.8-0.2.101mdk.x86_64.rpm
     0f50b3f9e0c34be38517114f488da47e x86_64/10.1/RPMS/libnspr4-1.7.8-0.2.101mdk.i586.rpm
     2d53455b98bd04cc956bf76e7ca03fdf x86_64/10.1/RPMS/lib64nss3-1.7.8-0.2.101mdk.x86_64.rpm
     fe938a6a0af7244498b117705185351c x86_64/10.1/RPMS/lib64nss3-devel-1.7.8-0.2.101mdk.x86_64.rpm
     5afe6299791f9b02ebe9ca50ad5af4f2 x86_64/10.1/RPMS/libnss3-1.7.8-0.2.101mdk.i586.rpm
     6c4326edda0d2a238b10cceccafa315a x86_64/10.1/RPMS/mozilla-1.7.8-0.2.101mdk.x86_64.rpm
     2e04f350de4c50d8ce0c08a8802358d3 x86_64/10.1/RPMS/mozilla-devel-1.7.8-0.2.101mdk.x86_64.rpm
     625797aba9d415f5a1e82f976491faf4 x86_64/10.1/RPMS/mozilla-dom-inspector-1.7.8-0.2.101mdk.x86_64.rpm
     a6b9add7c5e4a9047f53cae48d7cc8ad x86_64/10.1/RPMS/mozilla-enigmail-1.7.8-0.2.101mdk.x86_64.rpm
     d8ec50e909d4870d8123ce945c4cf70e x86_64/10.1/RPMS/mozilla-enigmime-1.7.8-0.2.101mdk.x86_64.rpm
     ea35499ad0e70efa833a3acf1ea4a2c1 x86_64/10.1/RPMS/mozilla-irc-1.7.8-0.2.101mdk.x86_64.rpm
     493381959561ef841fc6335cb8bdace8 x86_64/10.1/RPMS/mozilla-js-debugger-1.7.8-0.2.101mdk.x86_64.rpm
     d39ad6dbe8fb3684ae2fbc511dd227b4 x86_64/10.1/RPMS/mozilla-mail-1.7.8-0.2.101mdk.x86_64.rpm
     89ed0af6fbd5f8353bf0c359499280a3 x86_64/10.1/RPMS/mozilla-spellchecker-1.7.8-0.2.101mdk.x86_64.rpm
     b7f5fe1866b17d72281aacefce238eab x86_64/10.1/SRPMS/epiphany-1.2.8-4.3.101mdk.src.rpm
     8464ea621f75482c3a08fedb00729767 x86_64/10.1/SRPMS/galeon-1.3.17-3.3.101mdk.src.rpm
     9c8dea4d7f4b532329afb3cc945c654b x86_64/10.1/SRPMS/mozilla-1.7.8-0.2.101mdk.src.rpm

     Corporate 3.0:
     8481048cca68509bad7bec7298dbb984 corporate/3.0/RPMS/libnspr4-1.7.8-0.2.C30mdk.i586.rpm
     7bf9e70298786c06a13dd8cd07a85421 corporate/3.0/RPMS/libnspr4-devel-1.7.8-0.2.C30mdk.i586.rpm
     1c07227eafcb128b05f885120aacaa94 corporate/3.0/RPMS/libnss3-1.7.8-0.2.C30mdk.i586.rpm
     c691c7d158de44ebc0123cbf30bb3ba1 corporate/3.0/RPMS/libnss3-devel-1.7.8-0.2.C30mdk.i586.rpm
     44df63b1c3460ad588e8b3f8834880b5 corporate/3.0/RPMS/mozilla-1.7.8-0.2.C30mdk.i586.rpm
     f1f9d9153ecbb4085680920b09cc7148 corporate/3.0/RPMS/mozilla-devel-1.7.8-0.2.C30mdk.i586.rpm
     710865bf9ed1fe59fe3f8bda48bc9330 corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.2.C30mdk.i586.rpm
     8b1830ef05ef943a6472aaf643feef5e corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.2.C30mdk.i586.rpm
     b48ed83052a17e52b6fceaf326be1c78 corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.2.C30mdk.i586.rpm
     d87d974c52fb46bacc24920d8ca4f621 corporate/3.0/RPMS/mozilla-irc-1.7.8-0.2.C30mdk.i586.rpm
     115ce3ac351361140a8169b0b34db304 corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.2.C30mdk.i586.rpm
     43f2921fafc8c9d822d381380ea1b919 corporate/3.0/RPMS/mozilla-mail-1.7.8-0.2.C30mdk.i586.rpm
     9fa6f4ee933d024cf38caa5e0575d263 corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.2.C30mdk.i586.rpm
     2a768ee57f740885cf246a9e466c1b71 corporate/3.0/SRPMS/mozilla-1.7.8-0.2.C30mdk.src.rpm

     Corporate 3.0/X86_64:
     9e3cdf2eeafbe11ff0c8509916661276 x86_64/corporate/3.0/RPMS/lib64nspr4-1.7.8-0.2.C30mdk.x86_64.rpm
     6330410729f516564d598494f81a4a44 x86_64/corporate/3.0/RPMS/lib64nspr4-devel-1.7.8-0.2.C30mdk.x86_64.rpm
     d35b405b54428febe6d9545ef5104fce x86_64/corporate/3.0/RPMS/lib64nss3-1.7.8-0.2.C30mdk.x86_64.rpm
     2b3e8b026301699e213492f34fe79428 x86_64/corporate/3.0/RPMS/lib64nss3-devel-1.7.8-0.2.C30mdk.x86_64.rpm
     f28fc77e7d2af12c6579b0511fcad969 x86_64/corporate/3.0/RPMS/mozilla-1.7.8-0.2.C30mdk.x86_64.rpm
     218b54e477e066bcdc4500e8bdf90c13 x86_64/corporate/3.0/RPMS/mozilla-devel-1.7.8-0.2.C30mdk.x86_64.rpm
     00c9c9d1bfca743e6be4edd1fab0fb5d x86_64/corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.2.C30mdk.x86_64.rpm
     23ccbc4b1d1572a0bda25c8497a83a5d x86_64/corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.2.C30mdk.x86_64.rpm
     3ae747ee09d81dcceb435032db500c41 x86_64/corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.2.C30mdk.x86_64.rpm
     178e7551a893522351cdb633b3a251ff x86_64/corporate/3.0/RPMS/mozilla-irc-1.7.8-0.2.C30mdk.x86_64.rpm
     1431f59d6dfaabfcf9c74f0e52f30527 x86_64/corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.2.C30mdk.x86_64.rpm
     996537a7b1b60bbe53557a1da658470a x86_64/corporate/3.0/RPMS/mozilla-mail-1.7.8-0.2.C30mdk.x86_64.rpm
     d95814a734933529dd23656837e080f9 x86_64/corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.2.C30mdk.x86_64.rpm
     2a768ee57f740885cf246a9e466c1b71 x86_64/corporate/3.0/SRPMS/mozilla-1.7.8-0.2.C30mdk.src.rpm
     _______________________________________________________________________

     To upgrade automatically use MandrakeUpdate or urpmi. The verification
     of md5 checksums and GPG signatures is performed automatically for you.

     All packages are signed by Mandriva for security. You can obtain the
     GPG public key of the Mandriva Security Team by executing:

      gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

     You can view other update advisories for Mandriva Linux at:

      http://www.mandriva.com/security/advisories

     If you want to report vulnerabilities, please contact

      security_(at)_mandriva.com
     _______________________________________________________________________

     Type Bits/KeyID Date User ID
     pub 1024D/22458A98 2000-07-10 Mandriva Security Team
      <security*mandriva.com>

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (GNU/Linux)

    iD8DBQFC8GeZmqjQ0CJFipgRAivVAKCNvYuAeAB+Ygiwc5aq2P5mZmAotACg27oY
    FjcBIx8uWUD+ikThITCswII=
    =4AU1
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Thierry Zoller: "Re: [Full-disclosure] Cisco IOS Shellcode Presentation"

    Relevant Pages