Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3986 :
    David James discovered that the window.opener property     allows Chrome privilege escalation.

  - CVE-2009-3985 :
    Jordi Chanel discovered a spoofing vulnerability of the     URL location bar using the document.location property.

  - CVE-2009-3984 :
    Jonathan Morgan discovered that the icon indicating a     secure connection could be spoofed through the     document.location property.

  - CVE-2009-3983 :
    Takehiro Takahashi discovered that the NTLM     implementation is vulnerable to reflection attacks.

  - CVE-2009-3981 :
    Jesse Ruderman discovered a crash in the layout engine,     which might allow the execution of arbitrary code.

  - CVE-2009-3979 :
    Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel     and Olli Pettay discovered crashes in the layout engine,     which might allow the execution of arbitrary code.

The Mozilla XULRunner engine was updated to version 1.9.0.16, fixing lots of bugs and various security issues.

The following issues were fixed :

  - Crashes with evidence of memory corruption (1.9.0.16).
    (MFSA 2009-65 / CVE-2009-3979 / CVE-2009-3981)

  - (bmo#487872) NTLM reflection vulnerability. (MFSA     2009-68 / CVE-2009-3983)

  - (bmo#521461,bmo#514232) Location bar spoofing     vulnerabilities. (MFSA 2009-69 / CVE-2009-3984 /     CVE-2009-3985)

  - (bmo#522430) Privilege escalation via chrome     window.opener. (MFSA 2009-70 / CVE-2009-3986)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1674 advisory.

    Mozilla Firefox is an open source Web browser. XULRunner provides the XUL     Runtime environment for Mozilla Firefox.

    Several flaws were found in the processing of malformed web content. A web     page containing malicious content could cause Firefox to crash or,     potentially, execute arbitrary code with the privileges of the user running     Firefox. (CVE-2009-3979, CVE-2009-3981, CVE-2009-3986)

    A flaw was found in the Firefox NT Lan Manager (NTLM) authentication     protocol implementation. If an attacker could trick a local user that has     NTLM credentials into visiting a specially-crafted web page, they could     send arbitrary requests, authenticated with the user's NTLM credentials, to     other applications on the user's system. (CVE-2009-3983)

    A flaw was found in the way Firefox displayed the SSL location bar     indicator. An attacker could create an unencrypted web page that appears to     be encrypted, possibly tricking the user into believing they are visiting a     secure page. (CVE-2009-3984)

    A flaw was found in the way Firefox displayed blank pages after a user     navigates to an invalid address. If a user visits an attacker-controlled     web page that results in a blank page, the attacker could inject content     into that blank page, possibly tricking the user into believing they are     viewing a legitimate page. (CVE-2009-3985)

    For technical details regarding these flaws, refer to the Mozilla security     advisories for Firefox 3.0.16. You can find a link to the Mozilla     advisories in the References section of this errata.

    All Firefox users should upgrade to these updated packages, which contain     Firefox version 3.0.16, which corrects these issues. After installing the     update, Firefox must be restarted for the changes to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of Firefox is earlier than 3.0.16.  Such versions are potentially affected by the following security issues :

  - Multiple crashes can result in arbitrary code execution.
    (MFSA 2009-65)

  - The NTLM implementation is vulnerable to reflection     attacks in which NTLM credentials from one application     can be forwarded to another application. (MFSA 2009-68)

  - Multiple location bar spoofing vulnerabilities exist.     (MFSA 2009-69)

  - A content window which is opened by a chrome window     retains a reference to the chrome window via the     'window.opener' property, which can lead to privilege     escalation. (MFSA 2009-70)

  - The exception messages generated by the     'GeckoActiveXObject' differ based on whether or not the     requested COM object's ProgID is present in the system     registry. (MFSA 2009-71)

Security issues were identified and fixed in firefox 3.0.x :

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3979).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3980).

Unspecified vulnerability in the browser engine in Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3981).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user (CVE-2009-3983).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an http URL or a file URL by setting document.location to an https URL corresponding to a site that responds with a No Content (aka 204) status code and an empty body (CVE-2009-3984).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with an invalid URL by setting document.location to this URL, and then writing arbitrary web script or HTML to the associated blank document, a related issue to CVE-2009-2654 (CVE-2009-3985).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript with chrome privileges by leveraging a reference to a chrome window from a content window, related to the window.opener property (CVE-2009-3986).

The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects (CVE-2009-3987).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

From Red Hat Security Advisory 2009:1673 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2009-3979)

A flaw was found in the SeaMonkey NT Lan Manager (NTLM) authentication protocol implementation. If an attacker could trick a local user that has NTLM credentials into visiting a specially crafted web page, they could send arbitrary requests, authenticated with the user's NTLM credentials, to other applications on the user's system.
(CVE-2009-3983)

A flaw was found in the way SeaMonkey displayed the SSL location bar indicator. An attacker could create an unencrypted web page that appears to be encrypted, possibly tricking the user into believing they are visiting a secure page. (CVE-2009-3984)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
44821	Debian DSA-1956-1 : xulrunner - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
49898	SuSE 10 Security Update : XULRunner (ZYPP Patch Number 6734)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high
43171	RHEL 4 / 5 : firefox (RHSA-2009:1674)	Nessus	Red Hat Local Security Checks	2009/12/16	2024/11/4	critical
43173	Firefox < 3.0.16 Multiple Vulnerabilities	Nessus	Windows	2009/12/16	2018/7/16	high
43388	SuSE 11 Security Update : XULRunner (SAT Patch Number 1716)	Nessus	SuSE Local Security Checks	2009/12/22	2021/1/14	high
43394	Mandriva Linux Security Advisory : firefox (MDVSA-2009:339)	Nessus	Mandriva Local Security Checks	2009/12/23	2021/1/6	high
67974	Oracle Linux 3 / 4 : seamonkey (ELSA-2009-1673)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high

检测

插件搜索

high

high

critical

high

high

high

high