Severity: Medium
17 July, 2008
Summary:
§ This vulnerability affects: Firefox 2.0.0.15 and 3.0 for Windows, Linux, and Macintosh
§ How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, gaining complete control of it
§ What to do: Upgrade to Firefox 2.0.0.16 or 3.0.1
Severity: Medium
17 July, 2008
Summary:
§ This vulnerability affects: Firefox 2.0.0.15 and 3.0 for Windows, Linux, and Macintosh
§ How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, gaining complete control of it
§ What to do: Upgrade to Firefox 2.0.0.16 or 3.0.1
Exposure:
Late yesterday, the Mozilla Foundation released Firefox 3.0.1 and Firefox 2.0.0.16, fixing three security vulnerabilities (based on CVE-IDs) in the popular web browser. We summarize the vulnerabilities below:
§ CSS Reference Counter overflow vulnerability (2008-034). Firefox suffers from a vulnerability in one of its internal data structures (CSSValue Array). Specifically, Mozilla did not use a sufficient size for the variable used as a reference counter for CSS objects. By enticing one of your users to a web page that makes a large number of references to a CSS object, an attacker could exploit this vulnerability to overflow that particular variable and corrupt the memory. The attacker could then leverage this memory corruption either to crash Firefox or to execute code on your user’s machine, with your user’s privileges. Depending upon your user’s level of privilege, an attacker could potentially exploit this flaw to gain complete control of that user’s computer.
Mozilla Impact rating: Critical
§ Internet-connected application can launch Firefox with multiple tabs (2008-035). In their alert, Mozilla describes a very convoluted Firefox vulnerability that attackers will probably find difficult to exploit in the real world. In a nutshell, attackers can force other Internet-connected applications to launch Firefox and open multiple tabs. Firefox is supposed to prevent external applications from loading certain types of URIs. However, an attacker could exploit this vulnerability to force Firefox to handle URIs it otherwise wouldn’t. By enticing one of your users into clicking a specially crafted link in some other web browser, at attacker might exploit this flaw either to read data on that user’s disk or even to execute code on that user’s computer. If your user has local administrative privileges, an attacker could exploit this flaw to gain complete control of that user’s machine. Keep in mind, however, that an attacker can only leverage this flaw if your user has Firefox installed but doesn’t have it running, and he visits the malicious link or web page in some other web browser, or Internet-connected application. For more details about this convoluted vulnerability, see Mozilla’s advisory.
Mozilla Impact rating: Critical
§ GIF image handling vulnerabilities (2008-036). Firefox suffers from a vulnerability involving the way it parses specially malformed GIF images. By enticing one of your users into visiting a web page containing a malicious GIF image, an attacker could exploit this flaw to execute code on that user’s machine, with that user’s privileges. This flaw only affects Firefox 3 running on OS X computers. Since OS X separates administrator privileges from typical user privileges, an attacker could not gain full control of OS X computers by leveraging this vulnerability alone.
Mozilla Impact rating: Critical
Solution Path:
Mozilla has updated Firefox 2 and 3, correcting these security vulnerabilities. If you use Firefox in your network, we recommend that you download and deploy version 3.0.1 as soon as possible. Mozilla no longer supports the 1.5.x branch of Firefox; we recommend that 1.5.x users migrate to 3.0.1 now.
§ Windows
§ Linux
§ Mac OS X
If you prefer to stick with Firefox 2, you can get the fixed version here (2.0.0.16).
Note: The latest versions of Firefox 3.0 automatically inform you when a Firefox update is available. We highly recommend you keep this feature enabled so that Firefox receives its updates as soon as Mozilla releases them. To verify that you have Firefox configured to automatically check for updates, click Tools => Options => Advanced tab => Update tab. Make sure that “Firefox” is checked under “Automatically check for updates.” In this menu, you can configure Firefox to always download and install any update, or if you prefer, only to inform the user that the update exists.
For All WatchGuard Users:
Some of these attacks arrive as normal-looking HTTP traffic, which you must allow through your firewall if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.
Status:
The Mozilla Foundation has released Firefox 3.0.1 and 2.0.0.16, fixing these security issues.
References:
§ Vulnerabilities Fixed in Firefox 3.0.1