Vulnerabilities > CVE-2004-0903 - Remote Buffer Overflow vulnerability in Mozilla Browser Vcard Handling

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
mozilla
conectiva
redhat
suse
critical
nessus

Summary

Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message.

Nessus

  • NASL familyWindows
    NASL idTHUNDERBIRD_MULTIPLE_FLAWS.NASL
    descriptionThe remote host is using Mozilla and/or Thunderbird, an alternative mail user agent. The remote version of this software is vulnerable to several flaws that could allow an attacker to execute arbitrary code on the remote host. To exploit these flaws, an attacker would need to send a rogue email to a victim on the remote host.
    last seen2020-06-01
    modified2020-06-02
    plugin id14729
    published2004-09-15
    reporterThis script is Copyright (C) 2004-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/14729
    titleMozilla < 1.7.3 / Thunderbird < 0.8 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    if(description)
    {
     script_id(14729);
     script_version("1.20");
     script_cve_id("CVE-2004-0902", "CVE-2004-0903", "CVE-2004-0904");
     script_bugtraq_id(11174, 11171, 11170);
    
     script_name(english:"Mozilla < 1.7.3 / Thunderbird < 0.8 Multiple Vulnerabilities");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote host has an application that is affected by 
    multiple flaws." );
     script_set_attribute(attribute:"description", value:
    "The remote host is using Mozilla and/or Thunderbird, an 
    alternative mail user agent.
    
    The remote version of this software is vulnerable to 
    several flaws that could allow an attacker to execute 
    arbitrary code on the remote host.
    
    To exploit these flaws, an attacker would need to send a 
    rogue email to a victim on the remote host." );
     script_set_attribute(attribute:"solution", value:
    "Upgrade to Mozilla 1.7.3 or Thunderbird 0.8 or later." );
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
     script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"false");
    
     script_set_attribute(attribute:"plugin_publication_date", value: "2004/09/15");
     script_set_attribute(attribute:"vuln_publication_date", value: "2004/08/29");
     script_cvs_date("Date: 2018/08/22 16:49:14");
    script_set_attribute(attribute:"plugin_type", value:"local");
    script_set_attribute(attribute:"cpe",value:"cpe:/a:mozilla:mozilla");
    script_set_attribute(attribute:"cpe",value:"cpe:/a:mozilla:thunderbird");
    script_end_attributes();
    
     script_summary(english:"Determines the version of Mozilla");
     script_category(ACT_GATHER_INFO);
     script_copyright(english:"This script is Copyright (C) 2004-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
     script_family(english:"Windows");
     script_dependencies("mozilla_org_installed.nasl");
     script_require_keys("Mozilla/Thunderbird/Version");
     exit(0);
    }
    
    #
    
    include("misc_func.inc");
    
    
    ver = read_version_in_kb("Mozilla/Version");
    if (!isnull(ver))
    {
      if (
        ver[0] < 1 ||
        (
          ver[0] == 1 &&
          (
            ver[1] < 7 ||
            (ver[1] == 7 && ver[2] < 3)
          )
        )
      )  security_hole(get_kb_item("SMB/transport"));
    }
    
    ver = read_version_in_kb("Mozilla/Thunderbird/Version");
    if (!isnull(ver))
    {
      if (ver[0] == 0 && ver[1] < 8)
        security_hole(get_kb_item("SMB/transport"));
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_DA690355115911D9BC4A000C41E2CDAD.NASL
    descriptionGeorgi Guninski discovered a stack-based buffer overflow which may be triggered when viewing email messages with vCard attachments.
    last seen2020-06-01
    modified2020-06-02
    plugin id19141
    published2005-07-13
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/19141
    titleFreeBSD : mozilla -- vCard stack buffer overflow (da690355-1159-11d9-bc4a-000c41e2cdad)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(19141);
      script_version("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:36");
    
      script_cve_id("CVE-2004-0903");
      script_xref(name:"CERT", value:"414240");
    
      script_name(english:"FreeBSD : mozilla -- vCard stack buffer overflow (da690355-1159-11d9-bc4a-000c41e2cdad)");
      script_summary(english:"Checks for updated packages in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote FreeBSD host is missing one or more security-related
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Georgi Guninski discovered a stack-based buffer overflow which may be
    triggered when viewing email messages with vCard attachments."
      );
      # http://bugzilla.mozilla.org/show_bug.cgi?id=257314
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.mozilla.org/show_bug.cgi?id=257314"
      );
      # http://www.uscert.gov/cas/techalerts/TA04-261A.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2812f5e4"
      );
      # https://vuxml.freebsd.org/freebsd/da690355-1159-11d9-bc4a-000c41e2cdad.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7c235cba"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:linux-mozilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mozilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:mozilla-gtk1");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:thunderbird");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/09/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2004/09/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/07/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"thunderbird<0.7.3_1")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"mozilla<1.7.2_2,2")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"mozilla>=1.8.a,2<1.8.a3_1,2")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"mozilla-gtk1<1.7.2_3")) flag++;
    if (pkg_test(save_report:TRUE, pkg:"linux-mozilla<1.7.3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-107.NASL
    descriptionA number of vulnerabilities were fixed in mozilla 1.7.3, the following of which have been backported to mozilla packages for Mandrakelinux 10.0 : -
    last seen2020-06-01
    modified2020-06-02
    plugin id15521
    published2004-10-20
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15521
    titleMandrake Linux Security Advisory : mozilla (MDKSA-2004:107)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2004:107. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(15521);
      script_version ("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2004-0902", "CVE-2004-0903", "CVE-2004-0904", "CVE-2004-0905", "CVE-2004-0906", "CVE-2004-0908", "CVE-2004-0909");
      script_xref(name:"MDKSA", value:"2004:107");
    
      script_name(english:"Mandrake Linux Security Advisory : mozilla (MDKSA-2004:107)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A number of vulnerabilities were fixed in mozilla 1.7.3, the following
    of which have been backported to mozilla packages for Mandrakelinux
    10.0 :
    
      - 'Send page' heap overrun
    
        - JavaScript clipboard access
    
        - buffer overflow when displaying VCard
    
        - BMP integer overflow
    
        - javascript: link dragging
    
        - Malicious POP3 server III
    
    The details of all of these vulnerabilities are available from the
    Mozilla website."
      );
      # http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?e445b231"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64nspr4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64nspr4-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64nss3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64nss3-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnspr4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnspr4-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnss3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libnss3-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-enigmail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-enigmime");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-irc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-js-debugger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-mail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mozilla-spellchecker");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/10/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/10/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64nspr4-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64nspr4-devel-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64nss3-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64nss3-devel-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libnspr4-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libnspr4-devel-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libnss3-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libnss3-devel-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-devel-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-dom-inspector-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-enigmail-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-enigmime-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-irc-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-js-debugger-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-mail-1.6-12.2.100mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK10.0", reference:"mozilla-spellchecker-1.6-12.2.100mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2004-486.NASL
    descriptionUpdated mozilla packages that fix a number of security issues are now available. Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Jesse Ruderman discovered a cross-domain scripting bug in Mozilla. If a user is tricked into dragging a JavaScript link into another frame or page, it becomes possible for an attacker to steal or modify sensitive information from that site. Additionally, if a user is tricked into dragging two links in sequence to another window (not frame), it is possible for the attacker to execute arbitrary commands. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0905 to this issue. Gael Delalleau discovered an integer overflow which affects the BMP handling code inside Mozilla. An attacker could create a carefully crafted BMP file in such a way that it would cause Mozilla to crash or execute arbitrary code when the image is viewed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0904 to this issue. Georgi Guninski discovered a stack-based buffer overflow in the vCard display routines. An attacker could create a carefully crafted vCard file in such a way that it would cause Mozilla to crash or execute arbitrary code when viewed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0903 to this issue. Wladimir Palant discovered a flaw in the way JavaScript interacts with the clipboard. It is possible that an attacker could use malicious JavaScript code to steal sensitive data which has been copied into the clipboard. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0908 to this issue. Georgi Guninski discovered a heap based buffer overflow in the
    last seen2020-06-01
    modified2020-06-02
    plugin id15409
    published2004-10-02
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/15409
    titleRHEL 2.1 / 3 : mozilla (RHSA-2004:486)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2004:486. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(15409);
      script_version ("1.28");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2004-0902", "CVE-2004-0903", "CVE-2004-0904", "CVE-2004-0905", "CVE-2004-0908");
      script_xref(name:"RHSA", value:"2004:486");
      script_xref(name:"Secunia", value:"12526");
    
      script_name(english:"RHEL 2.1 / 3 : mozilla (RHSA-2004:486)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated mozilla packages that fix a number of security issues are now
    available.
    
    Mozilla is an open source Web browser, advanced email and newsgroup
    client, IRC chat client, and HTML editor.
    
    Jesse Ruderman discovered a cross-domain scripting bug in Mozilla. If
    a user is tricked into dragging a JavaScript link into another frame
    or page, it becomes possible for an attacker to steal or modify
    sensitive information from that site. Additionally, if a user is
    tricked into dragging two links in sequence to another window (not
    frame), it is possible for the attacker to execute arbitrary commands.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CVE-2004-0905 to this issue.
    
    Gael Delalleau discovered an integer overflow which affects the BMP
    handling code inside Mozilla. An attacker could create a carefully
    crafted BMP file in such a way that it would cause Mozilla to crash or
    execute arbitrary code when the image is viewed. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CVE-2004-0904 to this issue.
    
    Georgi Guninski discovered a stack-based buffer overflow in the vCard
    display routines. An attacker could create a carefully crafted vCard
    file in such a way that it would cause Mozilla to crash or execute
    arbitrary code when viewed. The Common Vulnerabilities and Exposures
    project (cve.mitre.org) has assigned the name CVE-2004-0903 to this
    issue.
    
    Wladimir Palant discovered a flaw in the way JavaScript interacts with
    the clipboard. It is possible that an attacker could use malicious
    JavaScript code to steal sensitive data which has been copied into the
    clipboard. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CVE-2004-0908 to this issue.
    
    Georgi Guninski discovered a heap based buffer overflow in the 'Send
    Page' feature. It is possible that an attacker could construct a link
    in such a way that a user attempting to forward it could result in a
    crash or arbitrary code execution. The Common Vulnerabilities and
    Exposures project (cve.mitre.org) has assigned the name CVE-2004-0902
    to this issue.
    
    Users of Mozilla should update to these updated packages, which
    contain backported patches and are not vulnerable to these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0902"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0903"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0904"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0905"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2004-0908"
      );
      # http://www.mozilla.org/projects/security/known-vulnerabilities.html#
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.mozilla.org/en-US/security/known-vulnerabilities/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2004:486"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:galeon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-chat");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-dom-inspector");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-js-debugger");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-mail");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-nspr");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-nspr-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-nss");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mozilla-nss-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2004/09/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2004/09/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/10/02");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(2\.1|3)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1 / 3.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2004:486";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"galeon-1.2.13-5.2.1")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-chat-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-devel-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-dom-inspector-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-js-debugger-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-mail-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-nspr-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-nspr-devel-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-nss-1.4.3-2.1.4")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mozilla-nss-devel-1.4.3-2.1.4")) flag++;
    
      if (rpm_check(release:"RHEL3", reference:"mozilla-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-chat-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-devel-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-dom-inspector-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-js-debugger-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-mail-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-nspr-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-nspr-devel-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-nss-1.4.3-3.0.4")) flag++;
      if (rpm_check(release:"RHEL3", reference:"mozilla-nss-devel-1.4.3-3.0.4")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "galeon / mozilla / mozilla-chat / mozilla-devel / etc");
      }
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200409-26.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200409-26 (Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities) Mozilla-based products are vulnerable to multiple security issues. Firstly, routines handling the display of BMP images and VCards contain an integer overflow and a stack buffer overrun. Specific pages with long links, when sent using the
    last seen2020-06-01
    modified2020-06-02
    plugin id14781
    published2004-09-21
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/14781
    titleGLSA-200409-26 : Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200409-26.
    #
    # The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14781);
      script_version("1.19");
      script_cvs_date("Date: 2019/08/02 13:32:41");
    
      script_cve_id("CVE-2004-0902", "CVE-2004-0903", "CVE-2004-0904", "CVE-2004-0905", "CVE-2004-0906", "CVE-2004-0907", "CVE-2004-0908", "CVE-2004-0909");
      script_xref(name:"GLSA", value:"200409-26");
    
      script_name(english:"GLSA-200409-26 : Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200409-26
    (Mozilla, Firefox, Thunderbird, Epiphany: New releases fix vulnerabilities)
    
        Mozilla-based products are vulnerable to multiple security issues.
        Firstly, routines handling the display of BMP images and VCards contain
        an integer overflow and a stack buffer overrun. Specific pages with
        long links, when sent using the 'Send Page' function, and links with
        non-ASCII hostnames could both cause heap buffer overruns.
        Several issues were found and fixed in JavaScript rights handling:
        untrusted script code could read and write to the clipboard, signed
        scripts could build confusing grant privileges dialog boxes, and when
        dragged onto trusted frames or windows, JavaScript links could access
        information and rights of the target frame or window. Finally,
        Mozilla-based mail clients (Mozilla and Mozilla Thunderbird) are
        vulnerable to a heap overflow caused by invalid POP3 mail server
        responses.
      
    Impact :
    
        An attacker might be able to run arbitrary code with the rights of the
        user running the software by enticing the user to perform one of the
        following actions: view a specially crafted BMP image or VCard, use the
        'Send Page' function on a malicious page, follow links with malicious
        hostnames, drag multiple JavaScript links in a row to another window,
        or connect to an untrusted POP3 mail server. An attacker could also use
        a malicious page with JavaScript to disclose clipboard contents or
        abuse previously-given privileges to request XPI installation
        privileges through a confusing dialog.
      
    Workaround :
    
        There is no known workaround covering all vulnerabilities."
      );
      # http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7.3
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?e445b231"
      );
      # http://www.us-cert.gov/cas/techalerts/TA04-261A.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.us-cert.gov/ncas/alerts/ta04-261a"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200409-26"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All users should upgrade to the latest stable version:
        # emerge sync
        # emerge -pv your-version
        # emerge your-version"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:epiphany");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-firefox-bin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-thunderbird");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mozilla-thunderbird-bin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2004/09/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/21");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-client/mozilla-firefox-bin", unaffected:make_list("ge 1.0_pre"), vulnerable:make_list("lt 1.0_pre"))) flag++;
    if (qpkg_check(package:"mail-client/mozilla-thunderbird-bin", unaffected:make_list("ge 0.8"), vulnerable:make_list("lt 0.8"))) flag++;
    if (qpkg_check(package:"www-client/mozilla", unaffected:make_list("ge 1.7.3"), vulnerable:make_list("lt 1.7.3"))) flag++;
    if (qpkg_check(package:"www-client/epiphany", unaffected:make_list("ge 1.2.9-r1"), vulnerable:make_list("lt 1.2.9-r1"))) flag++;
    if (qpkg_check(package:"www-client/mozilla-bin", unaffected:make_list("ge 1.7.3"), vulnerable:make_list("lt 1.7.3"))) flag++;
    if (qpkg_check(package:"mail-client/mozilla-thunderbird", unaffected:make_list("ge 0.8"), vulnerable:make_list("lt 0.8"))) flag++;
    if (qpkg_check(package:"www-client/mozilla-firefox", unaffected:make_list("ge 1.0_pre"), vulnerable:make_list("lt 1.0_pre"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Mozilla / Firefox / Thunderbird / Epiphany");
    }
    

Oval

accepted2013-04-29T04:09:32.576-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
descriptionStack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message.
familyunix
idoval:org.mitre.oval:def:10873
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleStack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to execute arbitrary code via malformed VCard attachments that are not properly handled when previewing a message.
version26