Vulnerabilities > CVE-2013-1710 - Improper Input Validation vulnerability in Mozilla products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Exploit-Db
description | Firefox 5.0 - 15.0.1 - __exposedProps__ XCS Code Execution. CVE-2013-1710. Remote exploit for windows platform |
id | EDB-ID:30474 |
last seen | 2016-02-03 |
modified | 2013-12-24 |
published | 2013-12-24 |
reporter | metasploit |
source | https://www.exploit-db.com/download/30474/ |
title | Firefox 5.0 - 15.0.1 - __exposedProps__ XCS Code Execution |
Metasploit
description This exploit gains remote code execution on Firefox 15-22 by abusing two separate Javascript-related vulnerabilities to ultimately inject malicious Javascript code into a context running with chrome:// privileges. id MSF:EXPLOIT/MULTI/BROWSER/FIREFOX_TOSTRING_CONSOLE_INJECTION last seen 2020-06-04 modified 2017-07-24 published 2014-08-15 references https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1710 reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/browser/firefox_tostring_console_injection.rb title Firefox toString console.time Privileged Javascript Injection description On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given invalid input, would throw an exception that did not have an __exposedProps__ property set. By re-setting this property on the exception object's prototype, the chrome-based defineProperty method is made available. With the defineProperty method, functions belonging to window and document can be overridden with a function that gets called from chrome-privileged context. From here, another vulnerability in the crypto.generateCRMFRequest function is used to "peek" into the context's private scope. Since the window does not have a chrome:// URL, the insecure parts of Components.classes are not available, so instead the AddonManager API is invoked to silently install a malicious plugin. id MSF:EXPLOIT/MULTI/BROWSER/FIREFOX_PROTO_CRMFREQUEST last seen 2020-06-07 modified 2017-08-29 published 2013-12-18 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/browser/firefox_proto_crmfrequest.rb title Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution
Nessus
NASL family Windows NASL id MOZILLA_THUNDERBIRD_1708_ESR.NASL description The installed version of Thunderbird ESR 17.x is earlier than 17.0.8 and is, therefore, potentially affected the following vulnerabilities: - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701) - Errors exist related to the update service and last seen 2020-06-01 modified 2020-06-02 plugin id 69271 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69271 title Mozilla Thunderbird ESR 17.x < 17.0.8 Multiple Vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2013-1140.NASL description From Red Hat Security Advisory 2013:1140 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1701) A flaw was found in the way Firefox generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1710) A flaw was found in the way Firefox handled the interaction between frames and browser history. An attacker could use this flaw to trick Firefox into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Firefox incorrectly handled Java applets. If a user launched an untrusted Java applet via Firefox, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-05-31 modified 2013-08-08 plugin id 69251 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69251 title Oracle Linux 5 / 6 : firefox (ELSA-2013-1140) NASL family SuSE Local Security Checks NASL id SUSE_11_MOZILLAFIREFOX-130810.NASL description This update to Firefox 17.0.8esr (bnc#833389) addresses : - (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734). (MFSA 2013-63 / CVE-2013-1701 / CVE-2013-1702) Miscellaneous memory safety hazards have been fixed (rv:23.0 / rv:17.0.8) : - (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater. (MFSA 2013-66 / CVE-2013-1706 / CVE-2013-1707) - (bmo#848253) Document URI misrepresentation and masquerading. (MFSA 2013-68 / CVE-2013-1709) - (bmo#871368) CRMF requests allow for code execution and XSS attacks. (MFSA 2013-69 / CVE-2013-1710) - (bmo#859072) Further Privilege escalation through Mozilla Updater. (MFSA 2013-71 / CVE-2013-1712) - (bmo#887098) Wrong principal used for validating URI for some JavaScript components. (MFSA 2013-72 / CVE-2013-1713) - (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest. (MFSA 2013-73 / CVE-2013-1714) - (bmo#406541) Local Java applets may read contents of local file system. (MFSA 2013-75 / CVE-2013-1717) last seen 2020-06-05 modified 2013-08-14 plugin id 69344 published 2013-08-14 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69344 title SuSE 11.2 / 11.3 Security Update : Mozilla Firefox (SAT Patch Numbers 8187 / 8191) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2735.NASL description Multiple security issues have been found in Iceweasel, Debian last seen 2020-03-17 modified 2013-08-09 plugin id 69277 published 2013-08-09 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69277 title Debian DSA-2735-1 : iceweasel - several vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-1142.NASL description An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1701) A flaw was found in the way Thunderbird generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1710) A flaw was found in the way Thunderbird handled the interaction between frames and browser history. An attacker could use this flaw to trick Thunderbird into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Thunderbird incorrectly handled Java applets. If a user launched an untrusted Java applet via Thunderbird, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-05-31 modified 2013-08-08 plugin id 69255 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69255 title RHEL 5 / 6 : thunderbird (RHSA-2013:1142) NASL family MacOS X Local Security Checks NASL id MACOSX_THUNDERBIRD_17_0_8_ESR.NASL description The installed version of Thunderbird ESR 17.x is prior to 17.0.8 and is, therefore, potentially affected the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701) - Unspecified errors exist related to HTML frames and history handling, JavaScript URI handling and web workers using last seen 2020-06-01 modified 2020-06-02 plugin id 69267 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69267 title Thunderbird ESR 17.x < 17.0.8 Multiple Vulnerabilities (Mac OS X) NASL family MacOS X Local Security Checks NASL id MACOSX_THUNDERBIRD_17_0_8.NASL description The installed version of Thunderbird is earlier than 17.0.8 and is, therefore, potentially affected by the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701, CVE-2013-1702) - Use-after-free errors exist related to DOM modification when using last seen 2020-06-01 modified 2020-06-02 plugin id 69266 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69266 title Thunderbird < 17.0.8 Multiple Vulnerabilities (Mac OS X) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_0998E79D005511E3905B0025905A4771.NASL description The Mozilla Project reports : MFSA 2013-63 Miscellaneous memory safety hazards (rv:23.0 / rv:17.0.8) MFSA 2013-64 Use after free mutating DOM during SetBody MFSA 2013-65 Buffer underflow when generating CRMF requests MFSA 2013-66 Buffer overflow in Mozilla Maintenance Service and Mozilla Updater MFSA 2013-67 Crash during WAV audio file decoding MFSA 2013-68 Document URI misrepresentation and masquerading MFSA 2013-69 CRMF requests allow for code execution and XSS attacks MFSA 2013-70 Bypass of XrayWrappers using XBL Scopes MFSA 2013-71 Further Privilege escalation through Mozilla Updater MFSA 2013-72 Wrong principal used for validating URI for some JavaScript components MFSA 2013-73 Same-origin bypass with web workers and XMLHttpRequest MFSA 2013-74 Firefox full and stub installer DLL hijacking MFSA 2013-75 Local Java applets may read contents of local file system last seen 2020-06-01 modified 2020-06-02 plugin id 69278 published 2013-08-09 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69278 title FreeBSD : mozilla -- multiple vulnerabilities (0998e79d-0055-11e3-905b-0025905a4771) NASL family Windows NASL id MOZILLA_FIREFOX_23.NASL description The installed version of Firefox is earlier than 23.0 and is, therefore, potentially affected by the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701, CVE-2013-1702) - Use-after-free errors exist related to DOM modification when using last seen 2020-06-01 modified 2020-06-02 plugin id 69269 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69269 title Firefox < 23.0 Multiple Vulnerabilities NASL family Windows NASL id MOZILLA_FIREFOX_1708_ESR.NASL description The installed version of Firefox ESR 17.x is earlier than 17.0.8, and is, therefore, potentially affected by the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701) - Errors exist related to the update service and last seen 2020-06-01 modified 2020-06-02 plugin id 69268 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69268 title Firefox ESR 17.x < 17.0.8 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-652.NASL description Changes in seamonkey : - update to SeaMonkey 2.20 (bnc#833389) - MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards - MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests - MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks - MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some JavaScript components - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - requires NSPR 4.10 and NSS 3.15 - removed obsolete seamonkey-shared-nss-db.patch Changes in seamonkey : - update to SeaMonkey 2.20 (bnc#833389) - MFSA 2013-63/CVE-2013-1701/CVE-2013-1702 Miscellaneous memory safety hazards - MFSA 2013-64/CVE-2013-1704 (bmo#883313) Use after free mutating DOM during SetBody - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests - MFSA 2013-67/CVE-2013-1708 (bmo#879924) Crash during WAV audio file decoding - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks - MFSA 2013-70/CVE-2013-1711 (bmo#843829) Bypass of XrayWrappers using XBL Scopes - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some JavaScript components - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - requires NSPR 4.10 and NSS 3.15 - removed obsolete seamonkey-shared-nss-db.patch Changes in xulrunner : - update to 17.0.8esr (bnc#833389) - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some JavaScript components - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Changes in xulrunner : - update to 17.0.8esr (bnc#833389) - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some JavaScript components - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system Changes in MozillaThunderbird : - update to Thunderbird 17.0.8 (bnc#833389) - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some JavaScript components - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - update Enigmail to 1.5.2 - bugfix release Changes in MozillaThunderbird : - update to Thunderbird 17.0.8 (bnc#833389) - MFSA 2013-63/CVE-2013-1701 Miscellaneous memory safety hazards - MFSA 2013-68/CVE-2013-1709 (bmo#838253) Document URI misrepresentation and masquerading - MFSA 2013-69/CVE-2013-1710 (bmo#871368) CRMF requests allow for code execution and XSS attacks - MFSA 2013-72/CVE-2013-1713 (bmo#887098) Wrong principal used for validating URI for some JavaScript components - MFSA 2013-73/CVE-2013-1714 (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest - MFSA 2013-75/CVE-2013-1717 (bmo#406541, bmo#738397) Local Java applets may read contents of local file system - update Enigmail to 1.5.2 - bugfix release Changes in mozilla-nss : - fix 32bit requirement, it last seen 2020-06-05 modified 2014-06-13 plugin id 75122 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75122 title openSUSE Security Update : MozillaFirefox / MozillaThunderbird / mozilla-nspr / etc (openSUSE-SU-2013:1348-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2013-1142.NASL description An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1701) A flaw was found in the way Thunderbird generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1710) A flaw was found in the way Thunderbird handled the interaction between frames and browser history. An attacker could use this flaw to trick Thunderbird into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Thunderbird incorrectly handled Java applets. If a user launched an untrusted Java applet via Thunderbird, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-05-31 modified 2013-08-08 plugin id 69246 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69246 title CentOS 5 / 6 : thunderbird (CESA-2013:1142) NASL family Windows NASL id MOZILLA_THUNDERBIRD_1708.NASL description The installed version of Thunderbird is a version prior to 17.0.8 and is, therefore, potentially affected by the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701, CVE-2013-1702) - Use-after-free errors exist related to DOM modification when using last seen 2020-06-01 modified 2020-06-02 plugin id 69270 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69270 title Mozilla Thunderbird < 17.0.8 Multiple Vulnerabilities NASL family Scientific Linux Local Security Checks NASL id SL_20130807_FIREFOX_ON_SL5_X.NASL description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1701) A flaw was found in the way Firefox generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross- site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1710) A flaw was found in the way Firefox handled the interaction between frames and browser history. An attacker could use this flaw to trick Firefox into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Firefox incorrectly handled Java applets. If a user launched an untrusted Java applet via Firefox, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-03-18 modified 2013-08-08 plugin id 69257 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69257 title Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20130807) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1924-2.NASL description USN-1924-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubufox and Unity Firefox Extension. Jeff Gilbert, Henrik Skupin, Ben Turner, Christian Holler, Andrew McCreight, Gary Kwong, Jan Varga and Jesse Ruderman discovered multiple memory safety issues in Firefox. If the user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1701, CVE-2013-1702) A use-after-free bug was discovered when the DOM is modified during a SetBody mutation event. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1704) A use-after-free bug was discovered when generating a CRMF request with certain parameters. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1705) Aki Helin discovered a crash when decoding a WAV file in some circumstances. An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1708) It was discovered that a document last seen 2020-06-01 modified 2020-06-02 plugin id 69235 published 2013-08-07 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69235 title Ubuntu 12.04 LTS / 12.10 / 13.04 : ubufox, unity-firefox-extension update (USN-1924-2) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1925-1.NASL description Jeff Gilbert and Henrik Skupin discovered multiple memory safety issues in Thunderbird. If the user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1701) It was discovered that a document last seen 2020-06-01 modified 2020-06-02 plugin id 69260 published 2013-08-08 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69260 title Ubuntu 12.04 LTS / 12.10 / 13.04 : thunderbird vulnerabilities (USN-1925-1) NASL family SuSE Local Security Checks NASL id SUSE_11_MOZILLAFIREFOX-130809.NASL description This update to Firefox 17.0.8esr (bnc#833389) addresses : - (bmo#855331, bmo#844088, bmo#858060, bmo#870200, bmo#874974, bmo#861530, bmo#854157, bmo#893684, bmo#878703, bmo#862185, bmo#879139, bmo#888107, bmo#880734). (MFSA 2013-63 / CVE-2013-1701 / CVE-2013-1702) Miscellaneous memory safety hazards have been fixed (rv:23.0 / rv:17.0.8) : - (bmo#888314, bmo#888361) Buffer overflow in Mozilla Maintenance Service and Mozilla Updater. (MFSA 2013-66 / CVE-2013-1706 / CVE-2013-1707) - (bmo#848253) Document URI misrepresentation and masquerading. (MFSA 2013-68 / CVE-2013-1709) - (bmo#871368) CRMF requests allow for code execution and XSS attacks. (MFSA 2013-69 / CVE-2013-1710) - (bmo#859072) Further Privilege escalation through Mozilla Updater. (MFSA 2013-71 / CVE-2013-1712) - (bmo#887098) Wrong principal used for validating URI for some JavaScript components. (MFSA 2013-72 / CVE-2013-1713) - (bmo#879787) Same-origin bypass with web workers and XMLHttpRequest. (MFSA 2013-73 / CVE-2013-1714) - (bmo#406541) Local Java applets may read contents of local file system. (MFSA 2013-75 / CVE-2013-1717) last seen 2020-06-05 modified 2013-08-14 plugin id 69343 published 2013-08-14 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69343 title SuSE 11.2 / 11.3 Security Update : Mozilla Firefox (SAT Patch Numbers 8187 / 8191) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2746.NASL description Multiple security issues have been found in Icedove, Debian last seen 2020-03-17 modified 2013-08-30 plugin id 69506 published 2013-08-30 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69506 title Debian DSA-2746-1 : icedove - several vulnerabilities NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2013-1140.NASL description Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1701) A flaw was found in the way Firefox generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1710) A flaw was found in the way Firefox handled the interaction between frames and browser history. An attacker could use this flaw to trick Firefox into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Firefox incorrectly handled Java applets. If a user launched an untrusted Java applet via Firefox, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-06-01 modified 2020-06-02 plugin id 69245 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69245 title CentOS 5 / 6 : firefox (CESA-2013:1140) NASL family Scientific Linux Local Security Checks NASL id SL_20130807_THUNDERBIRD_ON_SL5_X.NASL description Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1701) A flaw was found in the way Thunderbird generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1710) A flaw was found in the way Thunderbird handled the interaction between frames and browser history. An attacker could use this flaw to trick Thunderbird into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Thunderbird incorrectly handled Java applets. If a user launched an untrusted Java applet via Thunderbird, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-03-18 modified 2013-08-08 plugin id 69258 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69258 title Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20130807) NASL family Windows NASL id SEAMONKEY_220.NASL description The installed version of SeaMonkey is a version prior to 2.20. It is, therefore, potentially affected by the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701, CVE-2013-1702) - Use-after-free errors exist related to DOM modification when using last seen 2020-06-01 modified 2020-06-02 plugin id 69272 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69272 title SeaMonkey < 2.20 Multiple Vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2013-1142.NASL description From Red Hat Security Advisory 2013:1142 : An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1701) A flaw was found in the way Thunderbird generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1710) A flaw was found in the way Thunderbird handled the interaction between frames and browser history. An attacker could use this flaw to trick Thunderbird into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Thunderbird incorrectly handled Java applets. If a user launched an untrusted Java applet via Thunderbird, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-05-31 modified 2013-08-08 plugin id 69252 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69252 title Oracle Linux 6 : thunderbird (ELSA-2013-1142) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-1140.NASL description Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1701) A flaw was found in the way Firefox generated Certificate Request Message Format (CRMF) requests. An attacker could use this flaw to perform cross-site scripting (XSS) attacks or execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1710) A flaw was found in the way Firefox handled the interaction between frames and browser history. An attacker could use this flaw to trick Firefox into treating malicious content as if it came from the browser history, allowing for XSS attacks. (CVE-2013-1709) It was found that the same-origin policy could be bypassed due to the way Uniform Resource Identifiers (URI) were checked in JavaScript. An attacker could use this flaw to perform XSS attacks, or install malicious add-ons from third-party pages. (CVE-2013-1713) It was found that web workers could bypass the same-origin policy. An attacker could use this flaw to perform XSS attacks. (CVE-2013-1714) It was found that, in certain circumstances, Firefox incorrectly handled Java applets. If a user launched an untrusted Java applet via Firefox, the applet could use this flaw to obtain read-only access to files on the user last seen 2020-05-31 modified 2013-08-08 plugin id 69254 published 2013-08-08 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69254 title RHEL 5 / 6 : firefox (RHSA-2013:1140) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201309-23.NASL description The remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Further, a remote attacker could conduct XSS attacks, spoof URLs, bypass address space layout randomization, conduct clickjacking attacks, obtain potentially sensitive information, bypass access restrictions, modify the local filesystem, or conduct other unspecified attacks. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 70183 published 2013-09-28 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70183 title GLSA-201309-23 : Mozilla Products: Multiple vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_23.NASL description The installed version of Firefox is earlier than 23.0 and is, therefore, potentially affected by multiple vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701, CVE-2013-1702) - Use-after-free errors exist related to DOM modification when using last seen 2020-06-01 modified 2020-06-02 plugin id 69265 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69265 title Firefox < 23.0 Multiple Vulnerabilities (Mac OS X) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1924-1.NASL description Jeff Gilbert, Henrik Skupin, Ben Turner, Christian Holler, Andrew McCreight, Gary Kwong, Jan Varga and Jesse Ruderman discovered multiple memory safety issues in Firefox. If the user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1701, CVE-2013-1702) A use-after-free bug was discovered when the DOM is modified during a SetBody mutation event. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1704) A use-after-free bug was discovered when generating a CRMF request with certain parameters. If the user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1705) Aki Helin discovered a crash when decoding a WAV file in some circumstances. An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1708) It was discovered that a document last seen 2020-06-01 modified 2020-06-02 plugin id 69234 published 2013-08-07 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69234 title Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1924-1) NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_17_0_8_ESR.NASL description The installed version of Firefox ESR 17.x is earlier than 17.0.8 and is, therefore, potentially affected by the following vulnerabilities : - Various errors exist that could allow memory corruption conditions. (CVE-2013-1701) - Unspecified errors exist related to HTML frames and history handling, JavaScript URI handling and web workers using last seen 2020-06-01 modified 2020-06-02 plugin id 69264 published 2013-08-08 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69264 title Firefox ESR 17.x < 17.0.8 Multiple Vulnerabilities (Mac OS X)
Oval
accepted | 2014-10-06T04:02:42.205-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||
description | The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation. | ||||||||||||||||||||||||||||||||||||||||||||||||
family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||
id | oval:org.mitre.oval:def:18773 | ||||||||||||||||||||||||||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||
submitted | 2013-08-30T10:26:26.748+04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||
title | CRMF requests allow for code execution and XSS attacks | ||||||||||||||||||||||||||||||||||||||||||||||||
version | 35 |
Packetstorm
data source https://packetstormsecurity.com/files/download/124564/firefox_proto_crmfrequest.rb.txt id PACKETSTORM:124564 last seen 2016-12-05 published 2013-12-23 reporter metasploit.com source https://packetstormsecurity.com/files/124564/Firefox-15.0.1-Code-Execution.html title Firefox 15.0.1 Code Execution data source https://packetstormsecurity.com/files/download/127915/firefox_tostring_console_injection.rb.txt id PACKETSTORM:127915 last seen 2016-12-05 published 2014-08-18 reporter moz_bug_r_a4 source https://packetstormsecurity.com/files/127915/Firefox-toString-console.time-Privileged-Javascript-Injection.html title Firefox toString console.time Privileged Javascript Injection
Redhat
rpms |
|
Saint
bid | 61900 |
description | Firefox crypto.generateCRMFRequest command execution |
id | web_client_firefox |
osvdb | 96019 |
title | firefox_crypto_generatecrmfrequest |
type | client |
Seebug
bulletinFamily exploit description BUGTRAQ ID:61641 CVE ID:CVE-2013-1710 Mozilla Firefox/SeaMonkey/Thunderbird是Mozilla所发布的WEB浏览器/新闻组客户端/邮件客户端。 Mozilla Firefox/SeaMonkey/Thunderbird crypto.generateCRMFRequest函数存在安全漏洞,允许远程攻击者在某些情况下生成证书请求消息格式(Certificate Request Message Format)请求来执行任意Javascript代码或进行跨站脚本攻击。 0 Mozilla Firefox < 23.0 mozilla Firefox ESR 17.x mozilla Thunderbird < 17.0.8 mozilla Thunderbird ESR 17.x mozilla SeaMonkey < 2.20 厂商补丁: Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.mozilla.org id SSV:61208 last seen 2017-11-19 modified 2013-12-25 published 2013-12-25 reporter Root source https://www.seebug.org/vuldb/ssvid-61208 title Mozilla Firefox/SeaMonkey/Thunderbird CRMF请求生成跨站脚本漏洞 bulletinFamily exploit description No description provided by source. id SSV:87190 last seen 2017-11-19 modified 2014-08-20 published 2014-08-20 reporter Root source https://www.seebug.org/vuldb/ssvid-87190 title Firefox toString console.time Privileged Javascript Injection bulletinFamily exploit description No description provided by source. id SSV:83857 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-83857 title Firefox 5.0 - 15.0.1 - __exposedProps__ XCS Code Execution
References
- http://www.debian.org/security/2013/dsa-2735
- http://www.debian.org/security/2013/dsa-2746
- http://www.mozilla.org/security/announce/2013/mfsa2013-69.html
- http://www.securityfocus.com/bid/61900
- https://bugzilla.mozilla.org/show_bug.cgi?id=871368
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773