Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT Security Bulletin
ASB-2009.1040.5
Two new versions of Mozilla Firefox have been released
correcting a number of security vulnerabilities
24 August 2009
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Firefox 3.5.1
Firefox 3.0.12
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2009-2665 CVE-2009-2664 CVE-2009-2663
CVE-2009-2662 CVE-2009-2654 CVE-2009-2470
CVE-2009-2408 CVE-2009-2404
Member content until: Thursday, September 3 2009
Revision History: August 24 2009: Added additional fixes
August 19 2009: Updated impact section to included Mozilla
reference to CVE reference
August 5 2009: Added CVE references
August 4 2009: Version number correction
August 4 2009: Initial Release
OVERVIEW
Mozilla has released four advisories relating to Firefox. Mozilla has
rated two of these advisories as "Critical", one as "Moderate", and
one as "Low" impact.
IMPACT
According to Mozilla, the vulnerabilities corrected in this update are:
o MFSA 2009-38 (CVE-2009-2470): "Andrej Andolsek reported that when
Firefox receives a reply from a SOCKS5 proxy which contains a DNS
name longer than 15 characters, the subsequent data stream in the
response can become corrupted. There was no evidence of memory
corruption, however, and the severity of the issue was determined
to be low." [1]
o MFSA 2009-44 (CVE-2009-2654): "Security researcher Juan Pablo Lopez
Yacubian reported that an attacker could call window.open() on an
invalid URL which looks similar to a legitimate URL and then use
document.write() to place content within the new document, appearing
to have come from the spoofed location. Additionally, if the spoofed
document was created by a document with a valid SSL certificate, the
SSL indicators would be carried over into the spoofed document. An
attacker could use these issues to display misleading location and
SSL information for a malicious web page." [2]
o MFSA 2009-45 (CVE-2009-2663): "Mozilla developers and community members identified
and fixed several stability bugs in the browser engine used in
Firefox and other Mozilla-based products. Some of these crashes
showed evidence of memory corruption under certain circumstances
and we presume that with enough effort at least some of these could
be exploited to run arbitrary code." [3]
o MFSA 2009-46: "Mozilla add-on developer and community member
Wladimir Palant reported broken functionality on pages that had a
Link: HTTP header when an add-on was installed which implemented a
Content Policy in JavaScript, such as AdBlock Plus or NoScript.
Mozilla security researcher moz_bug_r_a4 demonstrated that the
broken functionality was due to the window's global object receiving
an incorrect security wrapper and that this issue could be used to
execute arbitrary JavaScript with chrome privileges.
Note: This vulnerability does not affect Firefox prior to version
3.5" [4]
o MFSA 2009-42 (CVE-2009-2408): "IOActive security researcher Dan
Kaminsky reported a mismatch in the treatment of domain names in
SSL certificates between SSL clients and the Certificate
Authorities (CA) which issue server certificates. In particular,
if a malicious person requested a certificate for a host name with
an invalid null character in it most CAs would issue the certificate
if the requester owned the domain specified after the null, while
most SSL clients (browsers) ignored that part of the name and used
the unvalidated part in front of the null. This made it possible for
attackers to obtain certificates that would function for any site
they wished to target. These certificates could be used to intercept
and potentially alter encrypted communication between the client and
a server such as sensitive bank account transactions." [5]
o MFSA 2009-43 (CVE-2009-2404): "Moxie Marlinspike reported a heap
overflow vulnerability in the code that handles regular expressions
in certificate names. This vulnerability could be used to compromise
the browser and run arbitrary code by presenting a specially crafted
certificate to the client. This code provided compatibility with the
non-standard regular expression syntax historically supported by
Netscape clients and servers. With version 3.5 Firefox switched to
the more limited industry-standard wildcard syntax instead and is not
vulnerable to this flaw." [6]
MITIGATION
These vulnerabilities have been fixed in Firefox 3.0.13, and Firefox
3.5.2 and can be downloaded from the Mozilla web site.
REFERENCES
[1] Mozilla Foundation Security Advisory 2009-38
http://www.mozilla.org/security/announce/2009/mfsa2009-38.html
[2] Mozilla Foundation Security Advisory 2009-44
http://www.mozilla.org/security/announce/2009/mfsa2009-44.html
[3] Mozilla Foundation Security Advisory 2009-45
http://www.mozilla.org/security/announce/2009/mfsa2009-45.html
[4] Mozilla Foundation Security Advisory 2009-46
http://www.mozilla.org/security/announce/2009/mfsa2009-46.html
[5] Mozilla Foundation Security Advisory 2009-42
http://www.mozilla.org/security/announce/2009/mfsa2009-42.html
[6] Mozilla Foundation Security Advisory 2009-43
http://www.mozilla.org/security/announce/2009/mfsa2009-43.html
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFKkgG8NVH5XJJInbgRAsXbAJ4y1SxEy8MudOWtuMOJ29vJryAo4ACfYvsl
62ZktGzdkDx0u3PHVW2OA8g=
=OOXy
-----END PGP SIGNATURE-----