Mozilla Firefox script-generated event security bypass
| mozilla-script-click-event-bypass (19170) |  High Risk |
Description:
Mozilla Firefox fails to properly differentiate between user-generated and synthetic click events. By creating a malicious Web page, a remote attacker could bypass the file download prompt and download malicious executables to the vulnerable system, once the user visits the Web page and uses the Alt-click feature.
Consequences:
Bypass Security
Remedy:
For Firefox:
Upgrade to the latest version (1.0 or later), available from the Mozilla Web site. See References.
For Ubuntu Linux:
Refer to USN-149-3 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- MFSA 2005-07: Script-generated event can download without prompting.
- Mozilla Web site: Firefox.
- BID-12407: Multiple Mozilla/Firefox/Thunderbird Vulnerabilities
- CVE-2005-0145: Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.
- USN-149-3: Ubuntu 4.10 update for Firefox vulnerabilities
Platforms Affected:
- Canonical Ubuntu 4.10
- Mozilla Firefox 0.10
- Mozilla Firefox 0.10 rc
- Mozilla Firefox 0.10.1
- Mozilla Firefox 0.7
- Mozilla Firefox 0.8
- Mozilla Firefox 0.9 rc
- Mozilla Firefox 0.9
- Mozilla Firefox 0.9.1
- Mozilla Firefox 0.9.2
- Mozilla Firefox 0.9.3
Reported:
Jan 31, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net