Mozilla Firefox chrome: and file: command line URI security bypass
| firefox-commandline-uri-security-bypass (43832) |  Medium Risk |
Description:
Mozilla Firefox could allow a remote attacker to bypass security restrictions, caused by an error when handling command line URIs. An attacker could exploit this vulnerably via pipe "|" symbols passed from another Internet-connected application when Firefox is not running to open multiple tabs via chrome: URIs, read data from the victim's disk via file: URIs following the placement of a malicious file in a guessable location, or execute arbitrary code using XUL based error pages.
Platforms Affected:
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 7.04
- Canonical, Ubuntu 7.10
- Canonical, Ubuntu 8.04 LTS
- Debian, Debian Linux 4.0
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.1 X86_64
- MandrakeSoft, Mandrake Linux 2008.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- Mozilla, Firefox 2.0.0.15
- Mozilla, Firefox 3.0
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4.5.z AS
- RedHat, Enterprise Linux 4.5.z ES
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
Remedy:
Refer to MFSA 2008-35 for patch, upgrade or suggested workaround information. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Bypass Security
References:
- MFSA 2008-35, Command-line URLs launch multiple tabs when Firefox not running at http://www.mozilla.org/security/announce/2008/mfsa2008-35.html.
- Mozilla Firefox Web site, Firefox web browser at http://www.mozilla.com/en-US/firefox/.
- NORTEL BULLETIN ID: 2009009505, Rev 1, Nortel Response to Sun Alert 256408 - Solaris 10 - Vulnerabilities in Firefox May Allow Execution of Arbitrary Code at http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=909495&poid=.
- Sun Alert ID: 256408, Multiple Security Vulnerabilities in Firefox Versions Before 2.0.0.19 May Allow Execution of Arbitrary Code or Access to Unauthorized Data at http://sunsolve.sun.com/search/document.do?assetkey=1-66-256408-1.
- ASA-2008-316: firefox security update (RHSA-2008-0598)
- ASA-2009-158: Multiple Security Vulnerabilities in Firefox Versions Before 2.0.0.19 May Allow Execution of Arbitrary Code or Access to unauthorized Data (Sun 256408)
- BID-30242: Mozilla Firefox URI Splitting Security Bypass Vulnerability
- CVE-2008-2933: Mozilla Firefox before 2.0.0.16, and 3.x before 3.0.1, interprets '|' (pipe) characters in a command-line URI as requests to open multiple tabs, which allows remote attackers to access chrome:i URIs, or read arbitrary local files via manipulations involving a series of URIs that is not entirely handled by a vector application, as exploited in conjunction with CVE-2008-2540. NOTE: this issue exists because of an insufficient fix for CVE-2005-2267.
- DSA-1614: iceweasel -- several vulnerabilities
- DSA-1615: xulrunner -- several vulnerabilities
- DSA-1697: iceape -- several vulnerabilities
- MDVSA-2008:148: Updated Firefox packages fix vulnerabilities
- RHSA-2008-0597: Critical: firefox security update
- RHSA-2008-0598: Critical: firefox security update
- SA31106: Mozilla Firefox 3 URI Launching and XUL Error Page Vulnerabilities
- SA31120: Mozilla Firefox 2 URI Launching Vulnerability
- SECTRACK ID: 1020500: Mozilla Firefox Command-line URL Processing Bug Lets Remote Users Open Tabs and Execute Arbitrary Code
- US-CERT VU#130923: Mozilla Firefox command line URI handling vulnerability
- USN-623-1: Firefox vulnerabilities
- USN-626-1: Firefox and xulrunner vulnerabilities
- USN-626-2: Devhelp, Epiphany, Midbrowser and Yelp update
Reported:
Jul 15, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net