Информационная безопасность
[RU] switch to English


Выполнение кода через обработчики URL в Mozilla Firefox / Thunderbird (code execution)
дополнено с 25 июля 2007 г.
Опубликовано:1 августа 2007 г.
Источник:
SecurityVulns ID:7978
Тип:клиент
Уровень опасности:
7/10
Описание:В случае, если для обработки URL типа mailto:, news:, nntp: и т.д. используется Thunderbird, возможно внедрение шел-символов.
Затронутые продукты:MOZILLA : Thunderbird 1.5
 MOZILLA : Firefox 2.0
 MOZILLA : Thunderbird 2.0
 ICEAPE : iceape 1.0
 XULRUNNER : xulrunner 1.8
 ICEAPE : iceape 1.1
CVE:CVE-2007-3845 (Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to execute arbitrary commands via certain vectors associated with launching "a file handling program based on the file extension at the end of the URI," a variant of CVE-2007-4041. NOTE: the vendor states that "it is still possible to launch a filetype handler based on extension rather than the registered protocol handler.")
 CVE-2007-3844 (Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka "Cross Context Scripting." NOTE: this issue is caused by a CVE-2007-3089 regression.)
Оригинальный текстdocumentMOZILLA, Mozilla Foundation Security Advisory 2007-27 (01.08.2007)
 documentMOZILLA, Mozilla Foundation Security Advisory 2007-26 (01.08.2007)
 documentThor Larholm, Re: [Full-disclosure] Mozilla protocol abuse (26.07.2007)
 documentThor Larholm, Mozilla protocol abuse (26.07.2007)
 documentBilly Rios, Remote Command Exec (FireFox 2.0.0.5 et al) (25.07.2007)
 documentBilly Rios, [Full-disclosure] More URI Handling Vulnerabilites (FireFox Remote Command Execution) (25.07.2007)
Файлы:Mozilla protocol abuse report and the XPI exploits

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород