Mozilla issues Firefox mega-fix

By Bill Brenner, Senior News Writer 02 Feb 2006 | SearchSecurity.com

Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

Updated Feb. 3 with information from Symantec on a flaw not fixed in the latest Firefox update.

Mozilla Corp. has fixed an array of security glitches in the popular Firefox browser late Wednesday. Malicious attackers could exploit the flaws to bypass security restrictions, compromise sensitive data and launch cross-site scripting attacks.

Four flaws affect Firefox version 1.5 specifically, while other problems affect various versions of Firefox, and possibly the Mozilla Thunderbird open source e-mail application under certain circumstances. The flaws and fixes were outlined in seven separate advisories:

The first problem is that "garbage collection hazards" were found in the JavaScript engine where "some routines used temporary variables that were not properly protected," Mozilla said. "Specially crafted objects could contain a user-defined method that would be called during the lifetime of these temporaries. If this method triggered garbage collection, the engine would operate on the unexpectedly freed temporary object when it returned from the user-defined routine."

The risk appears remote, Mozilla said, but "this type of memory corruption could potentially be used by an attacker to run arbitrary code."

The second problem is a dynamic style handling glitch that could be exploited to reference freed memory by changing the style of an element from "position:relative" to "position:static." Attackers could exploit this to run arbitrary code, Mozilla said.

The third problem is that calling the "QueryInterface" method of the built-in location and navigator objects can cause memory corruption, allowing an attacker to launch malicious code.

More on Firefox security Firefox flaw could expose sensitive data Column: What if Firefox were the target? The pros and cons of migrating to Firefox Security holes fixed in Firefox 1.0.7

The fourth problem is an input validation error in how the attribute name is processed when calling "XULDocument.persist()." Attackers could exploit this to inject XML and JavaScript code into "localstore.rdf," which would then run with the permissions of the browser, Mozilla said.

The fifth problem is that attackers could exploit some integer overflows in the E4X, SVG, and Canvas features to launch code.

The sixth problem is that an upgrade in the XML parser introduced a bug that could read beyond the end of the buffer, often causing a crash. "We don't know if this could be exploited to incorporate private data into the DOM of an XML document," Mozilla said, "but it could be a privacy risk if so."

The seventh problem is that the implementation of E4X introduced an internal "AnyName" object that was unintentionally exposed to Web content. "This singleton object could be used by two cooperating domains as a communication channel to get around same-origin restrictions that prevent direct access from one window or frame to another," Mozilla said.

The advisories come two days after Cupertino, Calif.-based Symantec Corp. e-mailed customers of its DeepSight Threat Management System an alert regarding a flaw in Firefox. The AV giant warned that the open source broswer is vulnerable to a flaw that could allow a Web page to "execute malicious script code in the context of an arbitrary domain." This could lead to a variety of attacks, "including theft of cookie-based authentication credentials," Symantec said.

"The issue affects the '-moz-binding' property that is used to attach extensible binding language (XBL) to elements through cascading style sheets (CSS)," Symantec said. "Due to an origin validation error, arbitrary script code included with XBL may be executed in the context of another domain. The cause of this issue is that the browser's same origin policy is not enforced on this property." This could allow a malicious site to access the properties of a trusted site and facilitate various attacks, including disclosure of sensitive information, Symantec said.

A Symantec spokesman said Wednesday that this particular flaw was not fixed in the latest Firefox update.

Tags: Application Attacks (Buffer Overflows, Cross-Site Scripting),  Web Browser Security,  Web Server Threats and Countermeasures,  Web Application and Web 2.0 Threats,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Application Attacks (Buffer Overflows, Cross-Site Scripting) Quiz: How to build secure applications Black box and white box testing: Which is best? Adobe warns of critical update for Reader, Acrobat 9.1.3 9 Ways to Improve Application Security After an Incident Developers Need Help with Security Errors Buffer overflow tutorial: How to find vulnerabilities, prevent attacks SQL injection protection: A guide on how to prevent and stop attacks Experts rebuke programmers who use SQL injection as feature SANS: Application threats, website flaws pose biggest security threats Mozilla helps Adobe push out faster patches Application Attacks (Buffer Overflows, Cross-Site Scripting) Research Web Browser Security Exploit code targets Internet Explorer zero-day display flaw InZero Systems launches hardware-based security gateway Web security firm ranks Firefox, Safari browsers as flaw prone Microsoft fixes security update that breaks Internet Explorer Mozilla update repairs Firefox buffer overflow vulnerabilities Kaspersky system analyzes malicious URLs on Twitter for malware Silon malware intercepts Internet Explorer sessions, steals credentials Do Facebook URL security concerns justify blocking social networks? Phishing attacks to remain a major problem, say security experts Adrian Perrig: Improve SSL/TLS Security Through Education and Technology Web Browser Security Research Web Server Threats and Countermeasures Increase in Gumblar backdoors poses FTP credential problems VeriSign extends DDoS attack protection service Microsoft issues IIS FTP advisory, exploit code circulates Panda reports fast-spreading rogueware antivirus fraud rakes in millions Oracle issues quarterly patches, fixes database flaws Latest DDoS attacks extremely unsophisticated, experts say Stolen FTP credentials likely in massive website attacks Microsoft warns of IIS zero-day vulnerability How to find and stop automated SQL injection attacks How to spot attacks through Apache Web server log analysis

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary buffer overflow  (SearchSecurity.com) cache poisoning  (SearchSecurity.com) cyberterrorism  (SearchSecurity.com) dictionary attack  (SearchSecurity.com) directory harvest attack  (SearchSecurity.com) distributed denial-of-service attack  (SearchSecurity.com) JavaScript hijacking  (SearchSecurity.com) ping of death  (SearchSecurity.com) stack smashing  (SearchSecurity.com) SYN flooding  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary