ID: 3643
Date: 19/06/2008
Title: 3643 - Critical vulnerability in Mozilla Firefox
Platform level affected:Net Application - Client
Hardware components affected:Intel PC
Specific operating systems components affected: 16-bit Windows
Net-enabled software: Other
Security software:Other
Other software: Web Browser
Remediation Summary:Special Event. Be on your guard at this time.
Vendors affected:Mozilla
Applications affected:Firefox
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Virulence: Proof of Concept
Warning Status: Active
Potential Damage: Remote execution/modification
Possible Duration: Open Ended
Availability of fix: Future
Type of fix: None
Source: Tipping Point
Reliability of source: Known
Source URL: http://dvlabs.tippingopint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30
Abstract: GovCertUK have been made aware of a 0-day Critical vulnerability affecting both the newly released Firefox 3.0 browser, along with older 2.0.x releases. Successful exploitation of the vulnerability could allow an attacker to execute arbitrary code on the client machine.
Mozilla Firefox Zero Day Vulnerability - Advisory
GovCertUK have been made aware of a 0-day Critical vulnerability affecting both the newly
released Firefox 3.0 browser, along with older 2.0.x releases. Successful exploitation of the
vulnerability could allow an attacker to execute arbitrary code on the client machine.
Affected Software
Mozilla Firefox 3.0
Mozilla Firefox 2.0.x (all versions)
Vulnerability Details
Firefox 3.0 was released by Mozilla on 18/06/08, and approximately five hours later a submission
was made to the Zero Day initiative detailing the 0-day vulnerability in the browser. They have
verified the vulnerability and reported it privately to Mozilla.
To successfully exploit this vulnerability user interaction is required, typically visiting a malicious
website or clicking a link in an email.
There is currently no patch available.
Comment / Mitigation
There are currently no known exploits for this vulnerability
Until Mozilla release a fix, users should consider using an alternative browser.
Mitigation set 1 applies.
Mitigation Information and factors
Mitigation refers to a software setting, common configuration or general best practice, existing in a
default state that could reduce the severity of exploitation of vulnerability. The following mitigating
factors may be helpful for securing your systems.
Mitigation factors - Set 1
In a Web-based attack scenario, an attacker could host a Web site that contains a Web
page that is used to exploit this vulnerability In addition, compromised Web sites and Web
sites that accept or host user-provided content could contain specially crafted content that
could exploit this vulnerability. Instead, an attacker would have to convince users to visit
the Web site, typically by getting them to click a link in an e-mail or Instant Messenger
message that takes users to the attacker's Web site.
An attacker who successfully exploited this vulnerability could gain the same user rights
as the local user. Users whose accounts are configured to have fewer user rights on the
system could be less impacted than users who operate with administrative user rights.
References
http://dvlabs.tippingopint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30
Telephone: 01242 709311
Fax: 01242 709113
General Enquiries:
enquiries@govcertuk.gov.uk
Incidents & Alerts:
incidents@govcertuk.gov.uk
Restricted Communications (GSI only):
govcertuk@cesg.gsi.gov.uk
Website:
www.govcertuk.gov.uk
This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK
information legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or infoleg@gchq.gsi.gov.uk.
This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.
The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.
CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.
Thu, 19 Jun 2008 15:00:00 GMT
Domain affected: Technical