Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Производитель ПО
Наименование ПО
Описание
Межзонная уязвимость в Mozilla Firefox заключается в том, что браузер относит заблокированные всплывающие окна к локальной файловой зоне, что позволяет злоумышленникам, действующим удаленно, преодолеть межзонные ограничения и получить права на чтение произвольных файлов по URI типа file://, если пользователь отобразит заблокированное всплывающее окно. Для эксплуатации уязвимости необходимы активные действия со стороны пользователя.
Как исправить
Для устранения уязвимости необходимо установить последнюю версию продукта, соответствующую используемой платформе. Необходимую информацию можно получить по адресу:
http://www.mozilla.org/
http://www.mozilla.org/
Ссылки
BUGTRAQ (20070205 Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://www.securityfocus.com/archive/1/archive/1/459162/100/0/threaded
BUGTRAQ (20070205 Re: [Full-disclosure] Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://www.securityfocus.com/archive/1/459163/100/0/threaded
BID (22396): http://www.securityfocus.com/bid/22396
BUGTRAQ (20070226 rPSA-2007-0040-1 firefox): http://www.securityfocus.com/archive/1/archive/1/461336/100/0/threaded
BUGTRAQ (20070303 rPSA-2007-0040-3 firefox thunderbird): http://www.securityfocus.com/archive/1/archive/1/461809/100/0/threaded
FULLDISC (20070205 Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052209.html
FULLDISC (20070205 Re: Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052211.html
http://www.mozilla.org/security/announce/2007/mfsa2007-05.html
https://issues.rpath.com/browse/RPL-1081
https://issues.rpath.com/browse/RPL-1103
FEDORA (FEDORA-2007-281): http://fedoranews.org/cms/node/2713
FEDORA (FEDORA-2007-293): http://fedoranews.org/cms/node/2728
GENTOO (GLSA-200703-04): http://security.gentoo.org/glsa/glsa-200703-04.xml
GENTOO (GLSA-200703-08): http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml
MANDRIVA (MDKSA-2007:050): http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:050
REDHAT (RHSA-2007:0079): http://www.redhat.com/support/errata/RHSA-2007-0079.html
REDHAT (RHSA-2007:0077): http://rhn.redhat.com/errata/RHSA-2007-0077.html
REDHAT (RHSA-2007:0078): http://www.redhat.com/support/errata/RHSA-2007-0078.html
REDHAT (RHSA-2007:0097): http://www.redhat.com/support/errata/RHSA-2007-0097.html
REDHAT (RHSA-2007:0108): http://www.redhat.com/support/errata/RHSA-2007-0108.html
SUSE (SUSE-SA:2007:019): http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
UBUNTU (USN-428-1): http://www.ubuntu.com/usn/usn-428-1
BID (22694): http://www.securityfocus.com/bid/22694
FRSIRT (ADV-2007-0718): http://www.frsirt.com/english/advisories/2007/0718
SECTRACK (1017702): http://www.securitytracker.com/id?1017702
XF (firefox-popup-security-bypass(32194)): http://xforce.iss.net/xforce/xfdb/32194
SGI (20070301-01-P): ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
BUGTRAQ (20070205 Re: [Full-disclosure] Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://www.securityfocus.com/archive/1/459163/100/0/threaded
BID (22396): http://www.securityfocus.com/bid/22396
BUGTRAQ (20070226 rPSA-2007-0040-1 firefox): http://www.securityfocus.com/archive/1/archive/1/461336/100/0/threaded
BUGTRAQ (20070303 rPSA-2007-0040-3 firefox thunderbird): http://www.securityfocus.com/archive/1/archive/1/461809/100/0/threaded
FULLDISC (20070205 Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052209.html
FULLDISC (20070205 Re: Firefox + popup blocker + XMLHttpRequest + srand() = oops): http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052211.html
http://www.mozilla.org/security/announce/2007/mfsa2007-05.html
https://issues.rpath.com/browse/RPL-1081
https://issues.rpath.com/browse/RPL-1103
FEDORA (FEDORA-2007-281): http://fedoranews.org/cms/node/2713
FEDORA (FEDORA-2007-293): http://fedoranews.org/cms/node/2728
GENTOO (GLSA-200703-04): http://security.gentoo.org/glsa/glsa-200703-04.xml
GENTOO (GLSA-200703-08): http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml
MANDRIVA (MDKSA-2007:050): http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:050
REDHAT (RHSA-2007:0079): http://www.redhat.com/support/errata/RHSA-2007-0079.html
REDHAT (RHSA-2007:0077): http://rhn.redhat.com/errata/RHSA-2007-0077.html
REDHAT (RHSA-2007:0078): http://www.redhat.com/support/errata/RHSA-2007-0078.html
REDHAT (RHSA-2007:0097): http://www.redhat.com/support/errata/RHSA-2007-0097.html
REDHAT (RHSA-2007:0108): http://www.redhat.com/support/errata/RHSA-2007-0108.html
SUSE (SUSE-SA:2007:019): http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
UBUNTU (USN-428-1): http://www.ubuntu.com/usn/usn-428-1
BID (22694): http://www.securityfocus.com/bid/22694
FRSIRT (ADV-2007-0718): http://www.frsirt.com/english/advisories/2007/0718
SECTRACK (1017702): http://www.securitytracker.com/id?1017702
XF (firefox-popup-security-bypass(32194)): http://xforce.iss.net/xforce/xfdb/32194
SGI (20070301-01-P): ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc
