Vulnerabilities > CVE-2008-3198 - Code Injection vulnerability in Mozilla Firefox 3.0

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
mozilla
CWE-94
nessus
NVD
Published: 2008-07-17
Updated: 2017-08-08

Summary

Mozilla Firefox 3.x before 3.0.1 allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors, as demonstrated by injection into a XUL error page. NOTE: this can be leveraged to execute arbitrary code using CVE-2008-2933.

Vulnerable Configurations

Part Description Count
Application
Mozilla
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Nessus

  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0597.NASL
    descriptionUpdated firefox packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 16th July 2008] The nspluginwrapper package has been added to this advisory to satisfy a missing package dependency issue. Mozilla Firefox is an open source Web browser. An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious website could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-2785) A flaw was found in the way Firefox handled certain command line URLs. If another application passed Firefox a malformed URL, it could result in Firefox executing local malicious content with chrome privileges. (CVE-2008-2933) All firefox users should upgrade to these updated packages, which contain Firefox 3.0.1 that corrects these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id43699
    published2010-01-06
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43699
    titleCentOS 5 : firefox (CESA-2008:0597)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2008:0597 and 
# CentOS Errata and Security Advisory 2008:0597 respectively.
#

include("compat.inc");

if (description)
{
  script_id(43699);
  script_version("1.15");
  script_cvs_date("Date: 2019/10/25 13:36:04");

  script_cve_id("CVE-2008-2785", "CVE-2008-2933", "CVE-2008-3198");
  script_bugtraq_id(29802, 30242);
  script_xref(name:"RHSA", value:"2008:0597");

  script_name(english:"CentOS 5 : firefox (CESA-2008:0597)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote CentOS host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated firefox packages that fix various security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the
Red Hat Security Response Team.

[Updated 16th July 2008] The nspluginwrapper package has been added to
this advisory to satisfy a missing package dependency issue.

Mozilla Firefox is an open source Web browser.

An integer overflow flaw was found in the way Firefox displayed
certain web content. A malicious website could cause Firefox to crash,
or execute arbitrary code with the permissions of the user running
Firefox. (CVE-2008-2785)

A flaw was found in the way Firefox handled certain command line URLs.
If another application passed Firefox a malformed URL, it could result
in Firefox executing local malicious content with chrome privileges.
(CVE-2008-2933)

All firefox users should upgrade to these updated packages, which
contain Firefox 3.0.1 that corrects these issues."
  );
  # https://lists.centos.org/pipermail/centos-announce/2008-July/015135.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?f663be08"
  );
  # https://lists.centos.org/pipermail/centos-announce/2008-July/015136.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?3030948c"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected firefox packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 94, 189);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:devhelp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:devhelp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:firefox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xulrunner-devel-unstable");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/06/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2008/07/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/06");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"CentOS Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/CentOS/release");
if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);

if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);


flag = 0;
if (rpm_check(release:"CentOS-5", reference:"devhelp-0.12-18.el5_2")) flag++;
if (rpm_check(release:"CentOS-5", reference:"devhelp-devel-0.12-18.el5_2")) flag++;
if (rpm_check(release:"CentOS-5", reference:"firefox-3.0.1-1.el5.centos")) flag++;
if (rpm_check(release:"CentOS-5", reference:"xulrunner-1.9.0.1-1.el5_2")) flag++;
if (rpm_check(release:"CentOS-5", reference:"xulrunner-devel-1.9.0.1-1.el5_2")) flag++;
if (rpm_check(release:"CentOS-5", reference:"xulrunner-devel-unstable-1.9.0.1-1.el5_2")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "devhelp / devhelp-devel / firefox / xulrunner / xulrunner-devel / etc");
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0597.NASL
    descriptionUpdated firefox packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 16th July 2008] The nspluginwrapper package has been added to this advisory to satisfy a missing package dependency issue. Mozilla Firefox is an open source Web browser. An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious website could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-2785) A flaw was found in the way Firefox handled certain command line URLs. If another application passed Firefox a malformed URL, it could result in Firefox executing local malicious content with chrome privileges. (CVE-2008-2933) All firefox users should upgrade to these updated packages, which contain Firefox 3.0.1 that corrects these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id33528
    published2008-07-17
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/33528
    titleRHEL 5 : firefox (RHSA-2008:0597)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2008:0597. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(33528);
  script_version ("1.24");
  script_cvs_date("Date: 2019/10/25 13:36:13");

  script_cve_id("CVE-2008-2785", "CVE-2008-2933", "CVE-2008-3198");
  script_bugtraq_id(29802, 30242);
  script_xref(name:"RHSA", value:"2008:0597");

  script_name(english:"RHEL 5 : firefox (RHSA-2008:0597)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated firefox packages that fix various security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the
Red Hat Security Response Team.

[Updated 16th July 2008] The nspluginwrapper package has been added to
this advisory to satisfy a missing package dependency issue.

Mozilla Firefox is an open source Web browser.

An integer overflow flaw was found in the way Firefox displayed
certain web content. A malicious website could cause Firefox to crash,
or execute arbitrary code with the permissions of the user running
Firefox. (CVE-2008-2785)

A flaw was found in the way Firefox handled certain command line URLs.
If another application passed Firefox a malformed URL, it could result
in Firefox executing local malicious content with chrome privileges.
(CVE-2008-2933)

All firefox users should upgrade to these updated packages, which
contain Firefox 3.0.1 that corrects these issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-2785"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-2933"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2008-3198"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2008:0597"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 94, 189);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:devhelp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:devhelp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:firefox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:nspluginwrapper");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xulrunner-devel-unstable");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:yelp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.2");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/06/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2008/07/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2008/07/17");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2008:0597";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL5", reference:"devhelp-0.12-18.el5")) flag++;

  if (rpm_check(release:"RHEL5", reference:"devhelp-devel-0.12-18.el5")) flag++;

  if (rpm_check(release:"RHEL5", reference:"firefox-3.0.1-1.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"nspluginwrapper-0.9.91.5-22.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"nspluginwrapper-0.9.91.5-22.el5")) flag++;

  if (rpm_check(release:"RHEL5", reference:"xulrunner-1.9.0.1-1.el5")) flag++;

  if (rpm_check(release:"RHEL5", reference:"xulrunner-devel-1.9.0.1-1.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"xulrunner-devel-unstable-1.9.0.1-1.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"xulrunner-devel-unstable-1.9.0.1-1.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"xulrunner-devel-unstable-1.9.0.1-1.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"i386", reference:"yelp-2.16.0-20.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"yelp-2.16.0-20.el5")) flag++;

  if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"yelp-2.16.0-20.el5")) flag++;


  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "devhelp / devhelp-devel / firefox / nspluginwrapper / xulrunner / etc");
  }
}
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_301.NASL
    descriptionThe installed version of Firefox is affected by various security issues : - By creating a very large number of references to a common CSS object, an attacker can overflow the CSS reference counter, causing a crash when the browser attempts to free the CSS object while still in use and allowing for arbitrary code execution (MFSA 2008-34). - If Firefox is not already running, passing it a command-line URI with pipe (
    last seen2020-06-01
    modified2020-06-02
    plugin id33522
    published2008-07-17
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/33522
    titleFirefox 3.x < 3.0.1 Multiple Vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#



include("compat.inc");

if (description)
{
  script_id(33522);
  script_version("1.16");

  script_cve_id("CVE-2008-2785", "CVE-2008-2933", "CVE-2008-3198");
  script_bugtraq_id(29802, 30242, 30244);

  script_name(english:"Firefox 3.x < 3.0.1 Multiple Vulnerabilities");
  script_summary(english:"Checks version of Firefox");

 script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a web browser that is affected by
multiple vulnerabilities." );
 script_set_attribute(attribute:"description", value:
"The installed version of Firefox is affected by various security
issues :

  - By creating a very large number of references to a 
    common CSS object, an attacker can overflow the CSS
    reference counter, causing a crash when the browser 
    attempts to free the CSS object while still in use
    and allowing for arbitrary code execution
    (MFSA 2008-34).

  - If Firefox is not already running, passing it a
    command-line URI with pipe ('|') symbols will open 
    multiple tabs, which could be used to launch 
    'chrome:i' URIs from the command-line or to pass URIs
    to Firefox that would normally be handled by a vector 
    application (MFSA 2008-35)." );
 script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-34/" );
 script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2008-35/" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to Firefox 3.0.1 or later." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(20, 94, 189);

 script_set_attribute(attribute:"plugin_publication_date", value: "2008/07/17");
 script_set_attribute(attribute:"patch_publication_date", value: "2008/07/15");
 script_cvs_date("Date: 2018/07/16 14:09:14");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox");
script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");
  script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
  script_dependencies("mozilla_org_installed.nasl");
  script_require_keys("Mozilla/Firefox/Version");
  exit(0);
}

include("mozilla_version.inc");
port = get_kb_item_or_exit("SMB/transport"); 

installs = get_kb_list("SMB/Mozilla/Firefox/*");
if (isnull(installs)) audit(AUDIT_NOT_INST, "Firefox");

mozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'3.0.1', min:'3.0', severity:SECURITY_HOLE);
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0597.NASL
    descriptionFrom Red Hat Security Advisory 2008:0597 : Updated firefox packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 16th July 2008] The nspluginwrapper package has been added to this advisory to satisfy a missing package dependency issue. Mozilla Firefox is an open source Web browser. An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious website could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-2785) A flaw was found in the way Firefox handled certain command line URLs. If another application passed Firefox a malformed URL, it could result in Firefox executing local malicious content with chrome privileges. (CVE-2008-2933) All firefox users should upgrade to these updated packages, which contain Firefox 3.0.1 that corrects these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67726
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67726
    titleOracle Linux 5 : firefox (ELSA-2008-0597)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2008:0597 and 
# Oracle Linux Security Advisory ELSA-2008-0597 respectively.
#

include("compat.inc");

if (description)
{
  script_id(67726);
  script_version("1.10");
  script_cvs_date("Date: 2019/10/25 13:36:07");

  script_cve_id("CVE-2008-2785", "CVE-2008-2933", "CVE-2008-3198");
  script_bugtraq_id(29802, 30242);
  script_xref(name:"RHSA", value:"2008:0597");

  script_name(english:"Oracle Linux 5 : firefox (ELSA-2008-0597)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Oracle Linux host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"From Red Hat Security Advisory 2008:0597 :

Updated firefox packages that fix various security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the
Red Hat Security Response Team.

[Updated 16th July 2008] The nspluginwrapper package has been added to
this advisory to satisfy a missing package dependency issue.

Mozilla Firefox is an open source Web browser.

An integer overflow flaw was found in the way Firefox displayed
certain web content. A malicious website could cause Firefox to crash,
or execute arbitrary code with the permissions of the user running
Firefox. (CVE-2008-2785)

A flaw was found in the way Firefox handled certain command line URLs.
If another application passed Firefox a malformed URL, it could result
in Firefox executing local malicious content with chrome privileges.
(CVE-2008-2933)

All firefox users should upgrade to these updated packages, which
contain Firefox 3.0.1 that corrects these issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2008-July/000685.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected firefox packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 94, 189);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:devhelp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:devhelp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:firefox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner-devel-unstable");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:yelp");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/06/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2008/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Oracle Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5", "Oracle Linux " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);

flag = 0;
if (rpm_check(release:"EL5", reference:"devhelp-0.12-18.el5")) flag++;
if (rpm_check(release:"EL5", reference:"devhelp-devel-0.12-18.el5")) flag++;
if (rpm_check(release:"EL5", reference:"firefox-3.0.1-1.0.1.el5")) flag++;
if (rpm_check(release:"EL5", reference:"xulrunner-1.9.0.1-1.0.1.el5")) flag++;
if (rpm_check(release:"EL5", reference:"xulrunner-devel-1.9.0.1-1.0.1.el5")) flag++;
if (rpm_check(release:"EL5", reference:"xulrunner-devel-unstable-1.9.0.1-1.0.1.el5")) flag++;
if (rpm_check(release:"EL5", reference:"yelp-2.16.0-20.el5")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "devhelp / devhelp-devel / firefox / xulrunner / xulrunner-devel / etc");
}

Redhat

advisories
bugzilla
id454697
titleCVE-2008-2933 Firefox command line URL launches multi-tabs
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 5 is installed
      ovaloval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • commentdevhelp-devel is earlier than 0:0.12-18.el5
          ovaloval:com.redhat.rhsa:tst:20080597001
        • commentdevhelp-devel is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20070097002
      • AND
        • commentdevhelp is earlier than 0:0.12-18.el5
          ovaloval:com.redhat.rhsa:tst:20080597003
        • commentdevhelp is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20070097004
      • AND
        • commentxulrunner-devel is earlier than 0:1.9.0.1-1.el5
          ovaloval:com.redhat.rhsa:tst:20080597005
        • commentxulrunner-devel is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20080569006
      • AND
        • commentxulrunner is earlier than 0:1.9.0.1-1.el5
          ovaloval:com.redhat.rhsa:tst:20080597007
        • commentxulrunner is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20080569004
      • AND
        • commentxulrunner-devel-unstable is earlier than 0:1.9.0.1-1.el5
          ovaloval:com.redhat.rhsa:tst:20080597009
        • commentxulrunner-devel-unstable is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20080569002
      • AND
        • commentyelp is earlier than 0:2.16.0-20.el5
          ovaloval:com.redhat.rhsa:tst:20080597011
        • commentyelp is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20070097006
      • AND
        • commentfirefox is earlier than 0:3.0.1-1.el5
          ovaloval:com.redhat.rhsa:tst:20080597013
        • commentfirefox is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20070097008
      • AND
        • commentnspluginwrapper is earlier than 0:0.9.91.5-22.el5
          ovaloval:com.redhat.rhsa:tst:20080597015
        • commentnspluginwrapper is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20080597016
rhsa
idRHSA-2008:0597
released2008-07-16
severityCritical
titleRHSA-2008:0597: firefox security update (Critical)
rpms
  • devhelp-0:0.12-18.el5
  • devhelp-debuginfo-0:0.12-18.el5
  • devhelp-devel-0:0.12-18.el5
  • firefox-0:3.0.1-1.el5
  • firefox-debuginfo-0:3.0.1-1.el5
  • nspluginwrapper-0:0.9.91.5-22.el5
  • nspluginwrapper-debuginfo-0:0.9.91.5-22.el5
  • xulrunner-0:1.9.0.1-1.el5
  • xulrunner-debuginfo-0:1.9.0.1-1.el5
  • xulrunner-devel-0:1.9.0.1-1.el5
  • xulrunner-devel-unstable-0:1.9.0.1-1.el5
  • yelp-0:2.16.0-20.el5
  • yelp-debuginfo-0:2.16.0-20.el5

References