{"id":3249,"date":"2006-04-18T09:42:17","date_gmt":"2006-04-18T07:42:17","guid":{"rendered":"http:\/\/calcolo.mi.infn.it\/?p=3249"},"modified":"2017-10-20T08:37:27","modified_gmt":"2017-10-20T08:37:27","slug":"news-n-313-us-cert-technical-cyber-security-alert-ta06-107a-mozilla-products-contain-multiple-vulnerabilities","status":"publish","type":"post","link":"https:\/\/calcolo.mi.infn.it\/?p=3249","title":{"rendered":"News n. 313 – US-CERT Technical Cyber Security Alert TA06-107A — Mozilla Products Contain Multiple Vulnerabilities"},"content":{"rendered":"

Sono state segnalate delle nuove vulnerabilita’ di Mozilla, Firefox e
\nThunderbird. Si raccomanda di effettuare i relativi upgrade.<\/p>\n

Domenica Quartarella
\nServizio Calcolo<\/p>\n

—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA1<\/p>\n

National Cyber Alert System<\/p>\n

Technical Cyber Security Alert TA06-107A<\/p>\n

Mozilla Products Contain Multiple Vulnerabilities<\/p>\n

Original release date: April 17, 2006
\n Last revised: —
\n Source: US-CERT<\/p>\n

Systems Affected<\/p>\n

* Mozilla web browser, email and newsgroup client
\n * Mozilla SeaMonkey
\n * Firefox web browser
\n * Thunderbird email client
\n * Mozilla Suite<\/p>\n

Any products based on Mozilla components, particularly Gecko may also
\n be affected.<\/p>\n

Overview<\/p>\n

The Mozilla web browser and derived products contain several
\n vulnerabilities, the most serious of which could allow a remote
\n attacker to execute arbitrary code on an affected system.<\/p>\n

I. Description<\/p>\n

Several vulnerabilities have been reported in the Mozilla web browser
\n and derived products. More detailed information is available in the
\n individual vulnerability notes, including:<\/p>\n

VU#932734 – Mozilla crypto.generateCRMFRequest() vulnerability<\/p>\n

A vulnerability exists in the Mozilla JavaScript routine
\n generateCRMFRequest() that may allow a remote attacker to execute
\n arbitrary code.
\n (CVE-2006-1728)<\/p>\n

VU#968814 – Mozilla JavaScript security bypass vulnerability<\/p>\n

Mozilla products fail to properly enforce security restrictions in
\n JavaScript. This vulnerability may allow a remote, unauthenticated
\n attacker to execute arbitrary code.
\n (CVE-2006-1726)<\/p>\n

VU#179014 – Mozilla CSS integer overflow vulnerability<\/p>\n

Mozilla products contain an integer overflow that could allow a
\n remote, unauthenticated attacker to execute arbitrary code.
\n (CVE-2006-1730)<\/p>\n

VU#488774 – Mozilla XBL binding vulnerability<\/p>\n

Mozilla products fail to properly restrict access to privileged XBL
\n bindings. This vulnerability may allow a remote, unauthenticated
\n attacker to execute arbitrary code.
\n (CVE-2006-1733)<\/p>\n

VU#842094 – Mozilla JavaScript cloned parent vulnerability<\/p>\n

Mozilla products fail to properly restrict access to a JavaScript
\n functions cloned parent. This vulnerability may allow a remote
\n attacker to execute arbitrary code on a vulnerable system.
\n (CVE-2006-1734)<\/p>\n

VU#813230 – Mozilla products vulnerable to privilege escalation via
\n XBL.method.eval<\/p>\n

A vulnerability in the way Mozilla products and derivative programs
\n handle certain XBL methods could allow a remote attacker to execute
\n arbitrary code on a vulnerable system.
\n (CVE-2006-1735)<\/p>\n

VU#736934 – Mozilla products vulnerable to memory corruption via a
\n particular sequence of HTML tags<\/p>\n

A vulnerability in the way Mozilla products and derivative programs
\n handle certain HTML tags could allow a remote attacker to execute
\n arbitrary code on a vulnerable system.
\n (CVE-2006-0749)<\/p>\n

VU#935556 – Mozilla products may allow CSS border-rendering code to
\n write past the end of an array<\/p>\n

A vulnerability in the way Mozilla products and derivative programs
\n handle certain CSS methods could allow a remote attacker to crash the
\n application or execute arbitrary code on a vulnerable system.
\n (CVE-2006-1739)<\/p>\n

VU#350262 – Mozilla DHTML memory corruption vulnerabilities<\/p>\n

Mozilla products contain to multiple, unspecified vulnerabilities in
\n the way they handle DHTML. These vulnerabilities may allow a remote
\n attacker to execute arbitrary code or cause a denial-of-service
\n condition.
\n (CVE-2006-1724)<\/p>\n

VU#252324 – Mozilla display style vulnerability<\/p>\n

Mozilla products contain an unspecified vulnerability in the way they
\n handle display styles. This vulnerability may allow a remote attacker
\n to execute arbitrary code or cause a denial-of-service condition.<\/p>\n

VU#329500 – Mozilla products vulnerable to memory corruption via large
\n regular expression in JavaScript<\/p>\n

A vulnerability in the way the JavaScript engine of Mozilla products
\n and derivative programs handles a large regular expression could allow
\n a remote attacker to crash the application or execute arbitrary code
\n on a vulnerable system.<\/p>\n

II. Impact<\/p>\n

The most severe impact of these vulnerabilities could allow a remote
\n attacker to execute arbitrary code with the privileges of the user
\n running the affected application. Other effects include a denial of
\n service or local information disclosure.<\/p>\n

III. Solution<\/p>\n

Upgrade<\/p>\n

Upgrade to Mozilla Firefox 1.5.0.2, Mozilla Thunderbird 1.5.0.2, or
\n SeaMonkey 1.0.1. According to Mozilla.org, Thunderbird 1.5.0.2 is
\n to be released on April 18, 2006.<\/p>\n

Users are strongly encourages to apply the workarounds described in
\n the individual vulnerability notes until updates can be applied.<\/p>\n

Appendix A. References<\/p>\n

* Mozilla Foundation Security Advisories –
\n <www.mozilla.org\/security\/announce\/<\/a>><\/p>\n

* Mozilla Foundation Security Advisories –
\n <www.mozilla.org\/projects\/security\/known-vulnerabilities.ht<\/a>
\n ml><\/p>\n

* US-CERT Vulnerability Note VU#932734 –
\n <www.kb.cert.org\/vuls\/id\/932734<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#968814 –
\n <www.kb.cert.org\/vuls\/id\/968814<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#179014 –
\n <www.kb.cert.org\/vuls\/id\/179014<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#488774 –
\n <www.kb.cert.org\/vuls\/id\/488774<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#842094 –
\n <www.kb.cert.org\/vuls\/id\/842094<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#813230 –
\n <www.kb.cert.org\/vuls\/id\/813230<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#736934 –
\n <www.kb.cert.org\/vuls\/id\/736934<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#935556 –
\n <www.kb.cert.org\/vuls\/id\/935556<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#350262 –
\n <www.kb.cert.org\/vuls\/id\/350262<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#252324 –
\n <www.kb.cert.org\/vuls\/id\/252324<\/a>><\/p>\n

* US-CERT Vulnerability Note VU#329500 –
\n <www.kb.cert.org\/vuls\/id\/329500<\/a>><\/p>\n

* US-CERT Vulnerability Notes Related to April Mozilla Security
\n Advisories –
\n <www.kb.cert.org\/vuls\/byid?searchview&query=mozilla_April_2<\/a>
\n 006><\/p>\n

* CVE-2006-1726 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1726<\/a>><\/p>\n

* CVE-2006-1728 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1728<\/a>><\/p>\n

* CVE-2006-1730 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1730<\/a>><\/p>\n

* CVE-2006-1733 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1733<\/a>><\/p>\n

* CVE-2006-1734 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1734<\/a>><\/p>\n

* CVE-2006-1735 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1735<\/a>><\/p>\n

* CVE-2006-0749 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-0749<\/a>><\/p>\n

* CVE-2006-1739 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1739<\/a>><\/p>\n

* CVE-2006-1724 –
\n <cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2006-1724<\/a>><\/p>\n

* Firefox – Rediscover the Web – <www.mozilla.com\/firefox\/<\/a>><\/p>\n

* Thunderbird – Reclaim your inbox –
\n <www.mozilla.com\/thunderbird\/<\/a>><\/p>\n

* The SeaMonkey Project –
\n <www.mozilla.org\/projects\/seamonkey\/<\/a>><\/p>\n

* Mozilla Suite – The All-in-One Internet Application Suite –
\n <www.mozilla.org\/products\/mozilla1.x\/<\/a>><\/p>\n

* Securing Your Web Browser –
\n <www.us-cert.gov\/reading_room\/securing_browser\/browser_secu<\/a>
\n rity.html#Mozilla_Firefox><\/p>\n

____________________________________________________________________<\/p>\n

The most recent version of this document can be found at:<\/p>\n

<www.us-cert.gov\/cas\/techalerts\/TA06-107A.html<\/a>>
\n ____________________________________________________________________<\/p>\n

Feedback can be directed to US-CERT Technical Staff. Please send
\n email to <cert@cert.org<\/a>> with “TA06-107A Feedback VU#968814” in the
\n subject.
\n ____________________________________________________________________<\/p>\n

For instructions on subscribing to or unsubscribing from this
\n mailing list, visit <www.us-cert.gov\/cas\/signup.html<\/a>>.
\n ____________________________________________________________________<\/p>\n

Produced 2006 by US-CERT, a government organization.<\/p>\n

Terms of use:<\/p>\n

<www.us-cert.gov\/legal.html<\/a>>
\n ____________________________________________________________________<\/p>\n

Revision History<\/p>\n

Apr 17, 2006: Initial release
\n—–BEGIN PGP SIGNATURE—–
\nVersion: GnuPG v1.2.1 (GNU\/Linux)<\/p>\n

iQEVAwUBREPpeH0pj593lg50AQI+OAf+LX6BsGayLqa86k2b32AUxeVYDiypaMEU
\nqriPcS7dNs1d4DG642cdXQFZeqVwd0n4IDuvRdwQfYYriDSwtASIZ3AHIkk0V\/rd
\n+9pJqPhxJ21ykRDbH+2pIrLb2Ph4oN3RLZRfec\/SxfgXqq5KF4Vf6ARkU1KNehnF
\nuD05huAn885W8dlmGAnNk5G5xgf6Bzd74UeYJws3zBSNqdUG9LSg16O7y1kP6uUk
\nwvXFkf1IMFjYhVuTMto763vEnmU3pBUoxnKpwgleD9NfCobYbn0h+Hq3QpS440u5
\n1xMXCu\/98aB3Zqsv717uJ+glD4VJ9T8EIEa4pW1qm3180XBpsN2ZQQ==
\n=2rzE
\n—–END PGP SIGNATURE—–<\/p>\n","protected":false},"excerpt":{"rendered":"

Sono state segnalate delle nuove vulnerabilita’ di Mozilla, Firefox e Thunderbird. Si raccomanda di effettuare i relativi upgrade. Domenica Quartarella Servizio Calcolo —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-107A Mozilla Products Contain Multiple Vulnerabilities Original release date: April 17, 2006 Last revised: — Source: US-CERT Systems Affected * Mozilla web browser, email and newsgroup client * Mozilla SeaMonkey * Firefox web browser * Thunderbird<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24],"tags":[],"class_list":["post-3249","post","type-post","status-publish","format-standard","hentry","category-news-calcolo-milano-it","post_format-standard"],"_links":{"self":[{"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=\/wp\/v2\/posts\/3249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3249"}],"version-history":[{"count":0,"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=\/wp\/v2\/posts\/3249\/revisions"}],"wp:attachment":[{"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/calcolo.mi.infn.it\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}