Mozilla Firefox script-generated event security bypass
| mozilla-script-click-event-bypass (19170) |  High Risk |
Description:
Mozilla Firefox fails to properly differentiate between user-generated and synthetic click events. By creating a malicious Web page, a remote attacker could bypass the file download prompt and download malicious executables to the vulnerable system, once the user visits the Web page and uses the Alt-click feature.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Mozilla, Firefox 0.10 rc
- Mozilla, Firefox 0.10
- Mozilla, Firefox 0.10.1
- Mozilla, Firefox 0.7
- Mozilla, Firefox 0.8
- Mozilla, Firefox 0.9 rc
- Mozilla, Firefox 0.9
- Mozilla, Firefox 0.9.1
- Mozilla, Firefox 0.9.2
- Mozilla, Firefox 0.9.3
Remedy:
For Firefox:
Upgrade to the latest version (1.0 or later), available from the Mozilla Web site. See References.
For Ubuntu Linux:
Refer to USN-149-3 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Bypass Security
References:
- MFSA 2005-07, Script-generated event can download without prompting at http://www.mozilla.org/security/announce/mfsa2005-07.html.
- Mozilla Web site, Firefox at http://www.mozilla.org/products/firefox/.
- BID-12407: Multiple Mozilla/Firefox/Thunderbird Vulnerabilities
- CVE-2005-0145: Firefox before 1.0 does not properly distinguish between user-generated and synthetic click events, which allows remote attackers to use Javascript to bypass the file download prompt when the user uses the Alt-click feature.
- USN-149-3: Ubuntu 4.10 update for Firefox vulnerabilities
Reported:
Jan 31, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net