Multiple Mozilla products translucent XUL content window spoofing
| mozilla-xul-window-spoofing (25827) |  Medium Risk |
Description:
Multiple Mozilla products, including Firefox and SeaMonkey, could allow a remote attacker to spoof certain windows in a Web browser, caused by a condition that can occur when XUL content windows interact with the browser history mechanism. An attacker could exploit this vulnerability using a malicious Web site to cause certain windows to become translucent, which could be used to trick a victim into executing arbitrary code.
Consequences:
Gain Access
Remedy:
Refer to Mozilla Foundation Security Advisory 2006-29 for upgrade or suggested workaround information. See References.
References:
- MFSA 2006-29: Spoofing with translucent windows.
- Mozilla Web site: The SeaMonkey Project.
- Mozilla Web site: Firefox - Rediscover the Web.
- ASA-2006-259: HP-UX Firefox Vulnerabilities
- ASA-2007-097: HP-UX Running Firefox Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (HPSBUX02153)
- BID-17516: Mozilla Suite, Firefox, SeaMonkey, and Thunderbird Multiple Remote Vulnerabilities
- CVE-2006-1725: Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 causes certain windows to become translucent due to an interaction between XUL content windows and the history mechanism, which might allow user-assisted remote attackers to trick users into executing arbitrary code.
- DSA-1046: mozilla -- several vulnerabilities
- SA19631: Firefox Multiple Vulnerabilities
- SA19649: Mozilla SeaMonkey Multiple Vulnerabilities
- VUPEN/ADV-2006-1356: Mozilla Products Memory Corruption and Information Disclosure Vulnerabilities
- VUPEN/ADV-2006-3748: HP-UX Security Update Fixes Mozilla Firefox Command Execution Vulnerabilities
- VUPEN/ADV-2008-0083: HP-UX Security Update Fixes Firefox Command Execution Vulnerabilities
Platforms Affected:
- Debian Debian Linux 3.1
- Mozilla Firefox 1.0
- Mozilla Firefox 1.0.1
- Mozilla Firefox 1.0.2
- Mozilla Firefox 1.0.3
- Mozilla Firefox 1.0.4
- Mozilla Firefox 1.0.5
- Mozilla Firefox 1.0.6
- Mozilla Firefox 1.0.7
- Mozilla Firefox 1.5 Beta2
- Mozilla Firefox 1.5 Beta1
- Mozilla Firefox 1.5
- Mozilla Firefox 1.5.0.1
- Mozilla Mozilla Suite 1.7.10
- Mozilla Mozilla Suite 1.7.11
- Mozilla Mozilla Suite 1.7.12
- Mozilla Mozilla Suite 1.7.6
- Mozilla Mozilla Suite 1.7.7
- Mozilla Mozilla Suite 1.7.8
- Mozilla SeaMonkey 1.0 Beta
- Mozilla SeaMonkey 1.0 Alpha
- Mozilla Thunderbird 1.0
- Mozilla Thunderbird 1.0.1
- Mozilla Thunderbird 1.0.2
- Mozilla Thunderbird 1.0.3
- Mozilla Thunderbird 1.0.4
- Mozilla Thunderbird 1.0.5
- Mozilla Thunderbird 1.0.5 Beta
- Mozilla Thunderbird 1.0.6
- Mozilla Thunderbird 1.0.7
- Mozilla Thunderbird 1.5
- Mozilla Thunderbird 1.5 Beta2
- Mozilla Thunderbird 1.5.0.1
Reported:
Apr 13, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net