Title: Mozilla Firefox OnUnload Memory Corruption Vulnerability
Severity: HIGH
Description:
Mozilla Firefox is prone to a remote memory-corruption vulnerability.
When Mozilla Firefox processes a malicious document during a location transition that is modified from within the 'onUnload' event handler, a memory-corruption vulnerability is triggered.
Note: This vulnerability is similar to the one being tracked in BID 22678 (Microsoft Internet Explorer OnUnload Null Pointer Dereference Vulnerability).
Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. This could facilitate the remote compromise of affected computers.
Mozilla Firefox version 2.0.0.1 is vulnerable to this issue; other versions are also likely affected.
Affected Products:
- HP HP-UX B.11.11
- HP HP-UX B.11.23
- Linux kernel 2.4.19
- Linux kernel 2.4.21
- Linux kernel 2.6.5
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Corporate Server 4.0
- MandrakeSoft Corporate Server 4.0.0 x86_64
- MandrakeSoft Linux Mandrake 2007.0
- MandrakeSoft Linux Mandrake 2007.0 x86_64
- Mozilla Camino 0.7.0 .0
- Mozilla Camino 0.8.0
- Mozilla Camino 0.8.3
- Mozilla Camino 0.8.4
- Mozilla Camino 1.0
- Mozilla Camino 1.0.1
- Mozilla Camino 1.0.2
- Mozilla Camino 1.0.3
- Mozilla Camino 1.5
- Mozilla Firefox 1.5.0.9
- Mozilla Firefox 2.0.0.1
- RedHat Advanced Workstation for the Itanium Processor 2.1.0
- RedHat Advanced Workstation for the Itanium Processor 2.1.0 IA64
- RedHat Desktop 3.0.0
- RedHat Desktop 4.0.0
- RedHat Enterprise Linux AS 2.1
- RedHat Enterprise Linux AS 2.1 IA64
- RedHat Enterprise Linux AS 3
- RedHat Enterprise Linux AS 4
- RedHat Enterprise Linux ES 2.1
- RedHat Enterprise Linux ES 2.1 IA64
- RedHat Enterprise Linux ES 3
- RedHat Enterprise Linux ES 4
- RedHat Enterprise Linux WS 2.1
- RedHat Enterprise Linux WS 2.1 IA64
- RedHat Enterprise Linux WS 3
- RedHat Enterprise Linux WS 4
- S.u.S.E. Linux 10.0 x86
- S.u.S.E. Linux 10.1 x86
- S.u.S.E. Linux 9.3 x86
- S.u.S.E. Linux Enterprise Server 8
- S.u.S.E. Linux Enterprise Server 9
- S.u.S.E. Novell Linux Desktop 9
- S.u.S.E. Novell Linux POS 9
- S.u.S.E. Open-Enterprise-Server
- S.u.S.E. SUSE LINUX Retail Solution 8.0.0
- S.u.S.E. SuSE Linux Openexchange Server 4.0.0
- S.u.S.E. SuSE Linux School Server for i386
- S.u.S.E. SuSE Linux Standard Server 8.0.0
- S.u.S.E. UnitedLinux 1.0.0
- S.u.S.E. openSUSE 10.2
- Slackware Linux 10.2.0
- Slackware Linux 11.0
- Turbolinux Home
- Turbolinux Multimedia
- Turbolinux Personal
- Turbolinux Turbolinux 10 F...
- Turbolinux Turbolinux Desktop 10.0.0
- Turbolinux Turbolinux FUJI
- Turbolinux Turbolinux Server 10.0.0
- Turbolinux Turbolinux Server 10.0.0 x86
- Turbolinux Turbolinux Server 10.0.0 x64
- Ubuntu Ubuntu Linux 5.10.0 amd64
- Ubuntu Ubuntu Linux 5.10.0 i386
- Ubuntu Ubuntu Linux 5.10.0 powerpc
- Ubuntu Ubuntu Linux 5.10.0 sparc
- Ubuntu Ubuntu Linux 6.10 amd64
- Ubuntu Ubuntu Linux 6.10 i386
- Ubuntu Ubuntu Linux 6.10 powerpc
- Ubuntu Ubuntu Linux 6.10 sparc
References:
- Camino: 1.5.1 Release Notes
- HP: HPSBUX02153 SSRT061181 rev.5 - HP-UX Running Firefox, Remote Unauthorized Access
- Mozilla: Mozilla Foundation Security Advisory 2007-08
- Mozilla - Bugzilla: Bug 371321 – memory corruption when onUnload is mixed with document.write()s
- Red Hat: RHSA-2007:0077-6 - seamonkey security update
- Red Hat: RHSA-2007:0078-2 - Thunderbird security update
- Secunia Research: Secunia Research: Internet Explorer 7 "onunload" Event Spoofing Vulner
- US-CERT: Vulnerability Note VU#393921 - Mozilla Firefox fails to properly handle JavaScri
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
