Severity: Medium
8 February, 2008
Summary:
- This vulnerability affects: Firefox 2.0.0.x for Windows, Linux, and Macintosh.
- How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
- Impact:Various results. In the worst case, attacker executes code on your user’s computer, gaining complete control of it
- What to do: Upgrade to Firefox 2.0.0.12.
Severity: Medium
8 February, 2008
Summary:
- This vulnerability affects: Firefox 2.0.0.x for Windows, Linux, and Macintosh.
- How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
- Impact:Various results. In the worst case, attacker executes code on your user’s computer, gaining complete control of it
- What to do: Upgrade to Firefox 2.0.0.12.
Exposure:
Yesterday, the Mozilla Foundation released Firefox 2.0.0.12, fixing ten security vulnerabilities in the popular web browser. We summarize three of the more critical vulnerabilities below:
- Memory corruption vulnerabilities (2008-01). Firefox suffers from several unspecified crash bugs, which corrupt memory. Mozilla presumes that with enough effort some of these memory corruption flaws could be exploited to run arbitrary code. To exploit these flaws, an attacker would first have to trick one of your users into visiting a maliciously crafted web page. If your user took the bait, the attacker could execute code on that user’s machine, with that user’s privileges. If your user were a local administrator or had root privileges, the attacker would gain total control of the victim’s computer.
- Web browser history and forward navigation stealing vulnerability (2008-06). Firefox suffers from an unspecified vulnerability involving the way it handles images when a user leaves a maliciously crafted web page. By enticing one of your users to such a web page (which the user will eventually leave), an attacker could exploit this flaw to steal that user’s navigation history, steal the user’s forward navigation information, or even crash Firefox. Furthermore, this Firefox crash seems to corrupt memory. Mozilla presumes an attacker could exploit this memory corruption to run arbitrary code on your user’s machine, with your user’s privileges, perhaps even gaining complete control of that user’s computer.
- Directory Traversal vulnerability involving Firefox extensions (2008-05). Mozilla has fixed the zero day vulnerability we first reported in a January 31 Wire post. Firefox doesn’t properly handle unescaped characters when processing extensions packaged in a particular way. If a victim has such an extension installed, and the attacker can entice the victim to a malicious web page, then the attacker can exploit this flaw in a directory traversal attack that would allow him to steal information from certain files on the targeted computer. More specifically, an attacker could exploit this flaw to read Firefox’s sessionstore.js file, which contains details about current web sessions, including session IDs and cookies. Attackers could leverage this information to help them hijack your user’s web sessions.
The remaining vulnerabilities include privilege escalation, Cross-Site Scripting (XSS), information disclosure, and many others. If you’d like to know more about them, check out Firefox’s known issues page. However, the vulnerabilities described above should convince you to upgrade your Firefox users to the fixed version at your earliest convenience.
Solution Path:
Mozilla has updated Firefox, correcting these security vulnerabilities. If you use Firefox in your network, we recommend that you download and deploy version 2.0.0.12 as soon as possible. Mozilla no longer supports the 1.5.x branch of Firefox. We recommend that 1.5.x users migrate to 2.0.0.12 now.
Note: The latest versions of Firefox 2.0 automatically inform you when a Firefox update is available. We highly recommend you keep this feature enabled so that Firefox receives its updates as soon as Mozilla releases them. To verify you have Firefox configured to automatically check for updates, click Tools => Options => Advanced tab => Update tab. Make sure that “Firefox” is checked under “Automatically check for updates.” In this menu, you can configure Firefox to automatically download and install the update, or to merely inform the user that the update exists.
For All WatchGuard Users:
Some of these attacks arrive as normal-looking HTTP traffic, which you must allow through your firewall if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.
Status:
The Mozilla Foundation has released Firefox 2.0.0.12, fixing these security issues.