Mozilla Firefox onUnload handler code execution
| mozilla-onunload-code-execution (32648) |  High Risk |
Description:
Mozilla Firefox could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of JavaScript onUnload handlers. A remote attacker could exploit this vulnerability by creating a specially-crafted Web page to corrupt memory and execute arbitrary code on the system with the privileges of the victim, if the attacker could persuade the victim to visit the malicious site.
Platforms Affected:
- Canonical, Ubuntu 5.10
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- Mozilla, Firefox 2.0.0.1
- Mozilla, Gecko 20060601
- Novell, Linux Desktop 9
- Novell, Linux POS 9
- Novell, Open Enterprise Server
- Novell, Open Enterprise Server
- Novell, OpenSUSE 10.2
- Novell, UnitedLinux 1.0
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Linux Advanced Workstation 2.1 Itanium
- SuSE, Linux Enterprise Server 8
- SuSE, SuSE Linux 10.0
- SuSE, SuSE Linux 10.1
- SuSE, SuSE Linux 9.3
- SuSE, SuSE Linux OpenExchange Server 4
- SuSE, SuSE Linux Retail Solution 8
- SuSE, SuSE Linux School Server
- SuSE, SuSE Linux Standard Server 8
- SuSE, SuSE SLED 10
- SuSE, SuSE SLES 10
- SuSE, SuSE SLES 9
Remedy:
Refer to MFSA 2007-08 for patch, upgrade, or suggested workaround information. See References.
For Ubuntu Linux:
Refer to USN-428-2 for patch, upgrade, or suggested workaround information. See References.
For SUSE Linux (Firefox):
Refer to SUSE-SA:2007:019 for patch, upgrade, or suggested workaround information. See References.
For Red Hat Linux (Thunderbird):
Refer to RHSA-2007:0078-2 for patch, upgrade, or suggested workaround information. See References.
For SUSE Linux (Mozilla):
Refer to SUSE-SA:2007:022 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Full-Disclosure Mailing List, Fri Feb 23 2007 - 06:49:41 CST, [Full-disclosure] Firefox: onUnload tailgating (MSIE7 entrapment bug variant) at http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0531.html.
- MFSA 2007-08, onUnload + document.write() memory corruption at http://www.mozilla.org/security/announce/2007/mfsa2007-08.html.
- Mozilla Bugzilla Bug 371321, memory corruption when onUnload is mixed with document.write()s at https://bugzilla.mozilla.org/show_bug.cgi?id=371321.
- ASA-2007-095: thunderbird security update (RHSA-2007-0078)
- BID-22679: Mozilla Firefox OnUnload Memory Corruption Vulnerability
- CVE-2007-1092: Mozilla Firefox 1.5.0.9 and 2.0.0.1, and SeaMonkey before 1.0.8 allow remote attackers to execute arbitrary code via JavaScript onUnload handlers that modify the structure of a document, wich triggers memory corruption due to the lack of a finalize hook on DOM window objects.
- MDKSA-2007:050: Updated Firefox packages fix multiple vulnerabilities
- MDKSA-2007:050-1: Updated Firefox packages fix multiple vulnerabilities
- RHSA-2007-0077: Critical: seamonkey security update
- RHSA-2007-0078: Critical: thunderbird security update
- RHSA-2007-0079: Critical: Firefox security update
- SECTRACK ID: 1017701: Mozilla Firefox onUnload Event and document.write() Race Condition May Let Remote Users Execute Arbitrary Code
- SUSE-SA:2007:019: MozillaFirefox security update 1.5.0.10/2.0.0.2
- SUSE-SA:2007:022: Mozilla security problems
- US-CERT VU#393921: Mozilla Firefox fails to properly handle JavaScript onUnload events
- USN-428-1: Firefox vulnerabilities
- USN-428-2: Firefox regression
Reported:
Feb 23, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net