Severity: Medium
24 September, 2008
Summary:
§This vulnerability affects: Firefox 2.0.0.16 and 3.01 (and previous versions) for Windows, Linux, and Macintosh
§How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
§Impact: Various results; in the worst case, attacker executes code on your user’s computer, gaining complete control of it
§What to do: Upgrade to Firefox 2.0.0.17 or 3.0.2
Severity: Medium
24 September, 2008
Summary:
§This vulnerability affects: Firefox 2.0.0.16 and 3.01 (and previous versions) for Windows, Linux, and Macintosh
§How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
§Impact: Various results; in the worst case, attacker executes code on your user’s computer, gaining complete control of it
§What to do: Upgrade to Firefox 2.0.0.17 or 3.0.2
Exposure:
Late yesterday, the Mozilla Foundation released irefox 3.0.2and irefox 2.0.0.17, fixing 16 security vulnerabilities (based on CVE-IDs) in the popular web browser. We summarize three of the vulnerabilities below:
§ Memory corruption vulnerabilities (2008-042). Firefox suffers from several crash bugs, which corrupt memory. Most of these memory corruption flaws involve the way Firefox handles images or graphics. Mozilla presumes that, with enough effort, some of these memory corruption flaws could be exploited to run arbitrary code. To exploit these flaws, an attacker would first have to trick one of your users into visiting a maliciously crafted web page. If your user took the bait, the attacker could execute code on that user’s machine, with that user’s privileges. And if the user happened to be a local administrator or had root privileges, the attacker would gain total control of the victim’s computer.
Mozilla Impact rating: Critical
§ Privilege elevation and code execution vulnerabilities (2008-041). Firefox suffers from various vulnerabilities involving the way it handles specially crafted JavaScript. By enticing one of your users to a web page containing malicious JavaScript, an attacker could exploit these flaws to execute arbitrary code with Chrome privileges. Typically, Firefox restricts what JavaScript run from external web sites can do. However, JavaScript running with Chrome privileges has no restrictions, which basically means the attacker could exploit this flaw to gain significant control over your computer.
Mozilla Impact rating: Critical
§ UTF-8 URL buffer overflow vulnerability (2008-037). Firefox suffers from a stack buffer overflow vulnerability having to do with the way it parses specially malformed UTF-8 encoded URLs. By enticing one of your users into clicking a malicious link, an attacker could exploit this vulnerability to execute code on your user’s machine, with your user’s privileges. Depending upon your user’s level of privilege, an attacker could potentially exploit this flaw to gain complete control of that user’s computer. This particular flaw only affects Firefox 2.x.
Mozilla Impact rating: Critical
Solution Path:
Mozilla has updated Firefox 2 and 3, correcting these security vulnerabilities. If you use Firefox in your network, we recommend that you download and deploy version 3.0.2 as soon as possible. Mozilla no longer supports the 1.5.x branch of Firefox; we recommend that 1.5.x users migrate to 3.0.2 now.
§ Windows
§ Linux
§ Mac OS X
If you prefer to stick with Firefox 2, you can get the fixed version here (2.0.0.17).
Note: The latest versions of Firefox 3.0 automatically inform you when a Firefox update is available. We highly recommend you keep this feature enabled so that Firefox receives its updates as soon as Mozilla releases them. To verify that you have Firefox configured to automatically check for updates, click Tools => Options => Advanced tab => Update tab. Make sure that “Firefox” is checked under “Automatically check for updates.” In this menu, you can configure Firefox to always download and install any update; or if you prefer, only to inform the user that an update exists.
For All WatchGuard Users:
Some of these attacks arrive as normal-looking HTTP traffic, which you must allow through your firewall if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.
Status:
The Mozilla Foundation has released Firefox 3.0.2 and 2.0.0.17, fixing these security issues.
References:
§ Vulnerabilities Fixed in Firefox 3.0.2