Multiple Mozilla products translucent XUL content window spoofing
| mozilla-xul-window-spoofing (25827) |  Medium Risk |
Description:
Multiple Mozilla products, including Firefox and SeaMonkey, could allow a remote attacker to spoof certain windows in a Web browser, caused by a condition that can occur when XUL content windows interact with the browser history mechanism. An attacker could exploit this vulnerability using a malicious Web site to cause certain windows to become translucent, which could be used to trick a victim into executing arbitrary code.
Platforms Affected:
- Debian, Debian Linux 3.1
- Mozilla, Firefox 1.0
- Mozilla, Firefox 1.0.1
- Mozilla, Firefox 1.0.2
- Mozilla, Firefox 1.0.3
- Mozilla, Firefox 1.0.4
- Mozilla, Firefox 1.0.5
- Mozilla, Firefox 1.0.6
- Mozilla, Firefox 1.0.7
- Mozilla, Firefox 1.5 Beta1
- Mozilla, Firefox 1.5
- Mozilla, Firefox 1.5 Beta2
- Mozilla, Firefox 1.5.0.1
- Mozilla, Mozilla Suite 1.7.10
- Mozilla, Mozilla Suite 1.7.11
- Mozilla, Mozilla Suite 1.7.12
- Mozilla, Mozilla Suite 1.7.6
- Mozilla, Mozilla Suite 1.7.7
- Mozilla, Mozilla Suite 1.7.8
- Mozilla, SeaMonkey 1.0 Alpha
- Mozilla, SeaMonkey 1.0 Beta
- Mozilla, Thunderbird 1.0
- Mozilla, Thunderbird 1.0.1
- Mozilla, Thunderbird 1.0.2
- Mozilla, Thunderbird 1.0.3
- Mozilla, Thunderbird 1.0.4
- Mozilla, Thunderbird 1.0.5
- Mozilla, Thunderbird 1.0.5 Beta
- Mozilla, Thunderbird 1.0.6
- Mozilla, Thunderbird 1.0.7
- Mozilla, Thunderbird 1.5 Beta2
- Mozilla, Thunderbird 1.5
- Mozilla, Thunderbird 1.5.0.1
Remedy:
Refer to Mozilla Foundation Security Advisory 2006-29 for upgrade or suggested workaround information. See References.
Consequences:
Gain Access
References:
- MFSA 2006-29, Spoofing with translucent windows at http://www.mozilla.org/security/announce/2006/mfsa2006-29.html.
- Mozilla Web site, The SeaMonkey Project at http://www.mozilla.org/projects/seamonkey/.
- Mozilla Web site, Firefox - Rediscover the Web at http://www.mozilla.com/firefox/.
- ASA-2006-259: HP-UX Firefox Vulnerabilities
- ASA-2007-097: HP-UX Running Firefox Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (HPSBUX02153)
- BID-17516: Mozilla Suite, Firefox, SeaMonkey, and Thunderbird Multiple Remote Vulnerabilities
- CVE-2006-1725: Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1 causes certain windows to become translucent due to an interaction between XUL content windows and the history mechanism, which might allow user-assisted remote attackers to trick users into executing arbitrary code.
- DSA-1046: mozilla -- several vulnerabilities
- SA19631: Firefox Multiple Vulnerabilities
- SA19649: Mozilla SeaMonkey Multiple Vulnerabilities
- VUPEN/ADV-2006-1356: Mozilla Products Memory Corruption and Information Disclosure Vulnerabilities
- VUPEN/ADV-2006-3748: HP-UX Security Update Fixes Mozilla Firefox Command Execution Vulnerabilities
- VUPEN/ADV-2008-0083: HP-UX Security Update Fixes Firefox Command Execution Vulnerabilities
Reported:
Apr 13, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net