From: Mandriva Security Team <security@mandriva.com.>
To: [email protected]Subject: MDKSA-2005:128 - Updated mozilla packages fix multiple vulnerabilities
Message-Id: <E1E0CyX-0004Zd-6m@mercury.mandriva.com.>
Sender: QATeam User <qateam@mercury.mandriva.com.>
Date: Wed, 03 Aug 2005 00:43:37 -0600
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Update Advisory
_______________________________________________________________________
Package name: mozilla
Advisory ID: MDKSA-2005:128
Date: August 2nd, 2005
Affected versions: 10.1, Corporate 3.0
______________________________________________________________________
Problem Description:
A number of vulnerabilities were reported and fixed in Mozilla 1.7.9.
The following vulnerabilities have been backported and patched for
this update:
In several places the browser UI did not correctly distinguish between
true user events, such as mouse clicks or keystrokes, and synthetic
events genenerated by web content. The problems ranged from minor
annoyances like switching tabs or entering full-screen mode, to a
variant on MFSA 2005-34 Synthetic events are now prevented from
reaching the browser UI entirely rather than depend on each potentially
spoofed function to protect itself from untrusted events
(MFSA 2005-45).
Scripts in XBL controls from web content continued to be run even when
Javascript was disabled. By itself this causes no harm, but it could be
combined with most script-based exploits to attack people running
vulnerable versions who thought disabling javascript would protect
them. In the Thunderbird and Mozilla Suite mail clients Javascript is
disabled by default for protection against denial-of-service attacks
and worms; this vulnerability could be used to bypass that protection
(MFSA 2005-46).
The InstallTrigger.install() method for launching an install accepts a
callback function that will be called with the final success or error
status. By forcing a page navigation immediately after calling the
install method this callback function can end up running in the context
of the new page selected by the attacker. This is true even if the user
cancels the unwanted install dialog: cancel is an error status. This
callback script can steal data from the new page such as cookies or
passwords, or perform actions on the user's behalf such as make a
purchase if the user is already logged into the target site. In
Firefox the default settings allow only http://addons.mozilla.org to
bring up this install dialog. This could only be exploited if users
have added questionable sites to the install whitelist, and if a
malicious site can convince you to install from their site that's a
much more powerful attack vector. In the Mozilla Suite the whitelist
feature is turned off by default, any site can prompt the user to
install software and exploit this vulnerability. The browser has been
fixed to clear any pending callback function when switching to a new
site (MFSA 2005-48).
When InstallVersion.compareTo() is passed an object rather than a
string it assumed the object was another InstallVersion without
verifying it. When passed a different kind of object the browser would
generally crash with an access violation. shutdown has demonstrated
that different javascript objects can be passed on some OS versions to
get control over the instruction pointer. We assume this could be
developed further to run arbitrary machine code if the attacker can get
exploit code loaded at a predictable address (MFSA 2005-50).
The original frame-injection spoofing bug was fixed in the Mozilla
Suite 1.7 and Firefox 0.9 releases. This protection was accidentally
bypassed by one of the fixes in the Firefox 1.0.3 and Mozilla Suite
1.7.7 releases (MFSA 2005-51).
A child frame can call top.focus() even if the framing page comes from
a different origin and has overridden the focus() routine. The call is
made in the context of the child frame. The attacker would look for a
target site with a framed page that makes this call but doesn't verify
that its parent comes from the same site. The attacker could steal
cookies and passwords from the framed page, or take actions on behalf
of a signed-in user. This attack would work only against sites that use
frames in this manner (MFSA 2005-52).
Alerts and prompts created by scripts in web pages are presented with
the generic title [JavaScript Application] which sometimes makes it
difficult to know which site created them. A malicious page could
attempt to cause a prompt to appear in front of a trusted site in an
attempt to extract information such as passwords from the user. In the
fixed version these prompts will contain the hostname from the page
which created it (MFSA 2005-54).
Parts of the browser UI relied too much on DOM node names without
taking different namespaces into account and verifying that nodes
really were of the expected type. An XHTML document could be used to
create fake <IMG> elements, for example, with content-defined
properties that the browser would access as if they were the trusted
built-in properties of the expected HTML elements. The severity of the
vulnerability would depend on what the attacker could convince the
victim to do, but could result in executing user-supplied script with
elevated "chrome" privileges. This could be used to install malicious
software on the victim's machine (MFSA 2005-55).
Improper cloning of base objects allowed web content scripts to walk up
the prototype chain to get to a privileged object. This could be used
to execute code with enhanced privileges (MFSA 2005-56).
The updated packages have been patched to address these issue. This
update also brings the mozilla shipped in Mandriva Linux 10.1 to
version 1.7.8 to ease maintenance. As a result, new galeon and
epiphany packages are also available for 10.1, and community contribs
packages that are built against mozilla have been rebuilt and are
also available via contribs.
_______________________________________________________________________
References:
http://www.mozilla.org/security/announce/mfsa2005-45.htmlhttp://www.mozilla.org/security/announce/mfsa2005-46.htmlhttp://www.mozilla.org/security/announce/mfsa2005-48.htmlhttp://www.mozilla.org/security/announce/mfsa2005-50.htmlhttp://www.mozilla.org/security/announce/mfsa2005-51.htmlhttp://www.mozilla.org/security/announce/mfsa2005-52.htmlhttp://www.mozilla.org/security/announce/mfsa2005-54.htmlhttp://www.mozilla.org/security/announce/mfsa2005-55.htmlhttp://www.mozilla.org/security/announce/mfsa2005-56.htmlhttp://secunia.com/advisories/15489/http://secunia.com/advisories/15549/http://secunia.com/advisories/15601/
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.1:
b1ed603e1d571bf55b35dcf3934715f0 10.1/RPMS/epiphany-1.2.8-4.3.101mdk.i586.rpm
1b7a293fd2ad206ccbc8774c439c0a4f 10.1/RPMS/epiphany-devel-1.2.8-4.3.101mdk.i586.rpm
b749ecba69520e77411144fb1019acd3 10.1/RPMS/galeon-1.3.17-3.3.101mdk.i586.rpm
0f50b3f9e0c34be38517114f488da47e 10.1/RPMS/libnspr4-1.7.8-0.2.101mdk.i586.rpm
c7e2ffd0049ee31f24462406990521be 10.1/RPMS/libnspr4-devel-1.7.8-0.2.101mdk.i586.rpm
5afe6299791f9b02ebe9ca50ad5af4f2 10.1/RPMS/libnss3-1.7.8-0.2.101mdk.i586.rpm
08dacfc4d6041f0ad91effb7620bfbb4 10.1/RPMS/libnss3-devel-1.7.8-0.2.101mdk.i586.rpm
b13923d572288eaf34db5ce21f84ca8a 10.1/RPMS/mozilla-1.7.8-0.2.101mdk.i586.rpm
f9434ca544adf8c81b5269206323e49d 10.1/RPMS/mozilla-devel-1.7.8-0.2.101mdk.i586.rpm
bb6fa6a7a6320a494f7406c97d56e18b 10.1/RPMS/mozilla-dom-inspector-1.7.8-0.2.101mdk.i586.rpm
a3f4980a03dba6247483413402605e1f 10.1/RPMS/mozilla-enigmail-1.7.8-0.2.101mdk.i586.rpm
94d9b3e19fe4386918dba744691d5e23 10.1/RPMS/mozilla-enigmime-1.7.8-0.2.101mdk.i586.rpm
904c348ecbee1bf452de597df8f59062 10.1/RPMS/mozilla-irc-1.7.8-0.2.101mdk.i586.rpm
ff0ca565c69e6773fd83d8b7cc625245 10.1/RPMS/mozilla-js-debugger-1.7.8-0.2.101mdk.i586.rpm
2a6f2bb208251f8d47697eb25e856d02 10.1/RPMS/mozilla-mail-1.7.8-0.2.101mdk.i586.rpm
cdd099b62c2b2144ac9c9f129f1256f1 10.1/RPMS/mozilla-spellchecker-1.7.8-0.2.101mdk.i586.rpm
b7f5fe1866b17d72281aacefce238eab 10.1/SRPMS/epiphany-1.2.8-4.3.101mdk.src.rpm
8464ea621f75482c3a08fedb00729767 10.1/SRPMS/galeon-1.3.17-3.3.101mdk.src.rpm
9c8dea4d7f4b532329afb3cc945c654b 10.1/SRPMS/mozilla-1.7.8-0.2.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
66b5ba7351c0dde849b78fb41720f7b3 x86_64/10.1/RPMS/epiphany-1.2.8-4.3.101mdk.x86_64.rpm
8d6f0504e88642e71104aa38dfdb801d x86_64/10.1/RPMS/epiphany-devel-1.2.8-4.3.101mdk.x86_64.rpm
9ed6595f414b7595c3e8c6b5c70fc8cd x86_64/10.1/RPMS/galeon-1.3.17-3.3.101mdk.x86_64.rpm
e781ff913b57bb5f1becce7934d03691 x86_64/10.1/RPMS/lib64nspr4-1.7.8-0.2.101mdk.x86_64.rpm
26c709082cb2a8dfc62603a5ee4226bc x86_64/10.1/RPMS/lib64nspr4-devel-1.7.8-0.2.101mdk.x86_64.rpm
0f50b3f9e0c34be38517114f488da47e x86_64/10.1/RPMS/libnspr4-1.7.8-0.2.101mdk.i586.rpm
2d53455b98bd04cc956bf76e7ca03fdf x86_64/10.1/RPMS/lib64nss3-1.7.8-0.2.101mdk.x86_64.rpm
fe938a6a0af7244498b117705185351c x86_64/10.1/RPMS/lib64nss3-devel-1.7.8-0.2.101mdk.x86_64.rpm
5afe6299791f9b02ebe9ca50ad5af4f2 x86_64/10.1/RPMS/libnss3-1.7.8-0.2.101mdk.i586.rpm
6c4326edda0d2a238b10cceccafa315a x86_64/10.1/RPMS/mozilla-1.7.8-0.2.101mdk.x86_64.rpm
2e04f350de4c50d8ce0c08a8802358d3 x86_64/10.1/RPMS/mozilla-devel-1.7.8-0.2.101mdk.x86_64.rpm
625797aba9d415f5a1e82f976491faf4 x86_64/10.1/RPMS/mozilla-dom-inspector-1.7.8-0.2.101mdk.x86_64.rpm
a6b9add7c5e4a9047f53cae48d7cc8ad x86_64/10.1/RPMS/mozilla-enigmail-1.7.8-0.2.101mdk.x86_64.rpm
d8ec50e909d4870d8123ce945c4cf70e x86_64/10.1/RPMS/mozilla-enigmime-1.7.8-0.2.101mdk.x86_64.rpm
ea35499ad0e70efa833a3acf1ea4a2c1 x86_64/10.1/RPMS/mozilla-irc-1.7.8-0.2.101mdk.x86_64.rpm
493381959561ef841fc6335cb8bdace8 x86_64/10.1/RPMS/mozilla-js-debugger-1.7.8-0.2.101mdk.x86_64.rpm
d39ad6dbe8fb3684ae2fbc511dd227b4 x86_64/10.1/RPMS/mozilla-mail-1.7.8-0.2.101mdk.x86_64.rpm
89ed0af6fbd5f8353bf0c359499280a3 x86_64/10.1/RPMS/mozilla-spellchecker-1.7.8-0.2.101mdk.x86_64.rpm
b7f5fe1866b17d72281aacefce238eab x86_64/10.1/SRPMS/epiphany-1.2.8-4.3.101mdk.src.rpm
8464ea621f75482c3a08fedb00729767 x86_64/10.1/SRPMS/galeon-1.3.17-3.3.101mdk.src.rpm
9c8dea4d7f4b532329afb3cc945c654b x86_64/10.1/SRPMS/mozilla-1.7.8-0.2.101mdk.src.rpm
Corporate 3.0:
8481048cca68509bad7bec7298dbb984 corporate/3.0/RPMS/libnspr4-1.7.8-0.2.C30mdk.i586.rpm
7bf9e70298786c06a13dd8cd07a85421 corporate/3.0/RPMS/libnspr4-devel-1.7.8-0.2.C30mdk.i586.rpm
1c07227eafcb128b05f885120aacaa94 corporate/3.0/RPMS/libnss3-1.7.8-0.2.C30mdk.i586.rpm
c691c7d158de44ebc0123cbf30bb3ba1 corporate/3.0/RPMS/libnss3-devel-1.7.8-0.2.C30mdk.i586.rpm
44df63b1c3460ad588e8b3f8834880b5 corporate/3.0/RPMS/mozilla-1.7.8-0.2.C30mdk.i586.rpm
f1f9d9153ecbb4085680920b09cc7148 corporate/3.0/RPMS/mozilla-devel-1.7.8-0.2.C30mdk.i586.rpm
710865bf9ed1fe59fe3f8bda48bc9330 corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.2.C30mdk.i586.rpm
8b1830ef05ef943a6472aaf643feef5e corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.2.C30mdk.i586.rpm
b48ed83052a17e52b6fceaf326be1c78 corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.2.C30mdk.i586.rpm
d87d974c52fb46bacc24920d8ca4f621 corporate/3.0/RPMS/mozilla-irc-1.7.8-0.2.C30mdk.i586.rpm
115ce3ac351361140a8169b0b34db304 corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.2.C30mdk.i586.rpm
43f2921fafc8c9d822d381380ea1b919 corporate/3.0/RPMS/mozilla-mail-1.7.8-0.2.C30mdk.i586.rpm
9fa6f4ee933d024cf38caa5e0575d263 corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.2.C30mdk.i586.rpm
2a768ee57f740885cf246a9e466c1b71 corporate/3.0/SRPMS/mozilla-1.7.8-0.2.C30mdk.src.rpm
Corporate 3.0/X86_64:
9e3cdf2eeafbe11ff0c8509916661276 x86_64/corporate/3.0/RPMS/lib64nspr4-1.7.8-0.2.C30mdk.x86_64.rpm
6330410729f516564d598494f81a4a44 x86_64/corporate/3.0/RPMS/lib64nspr4-devel-1.7.8-0.2.C30mdk.x86_64.rpm
d35b405b54428febe6d9545ef5104fce x86_64/corporate/3.0/RPMS/lib64nss3-1.7.8-0.2.C30mdk.x86_64.rpm
2b3e8b026301699e213492f34fe79428 x86_64/corporate/3.0/RPMS/lib64nss3-devel-1.7.8-0.2.C30mdk.x86_64.rpm
f28fc77e7d2af12c6579b0511fcad969 x86_64/corporate/3.0/RPMS/mozilla-1.7.8-0.2.C30mdk.x86_64.rpm
218b54e477e066bcdc4500e8bdf90c13 x86_64/corporate/3.0/RPMS/mozilla-devel-1.7.8-0.2.C30mdk.x86_64.rpm
00c9c9d1bfca743e6be4edd1fab0fb5d x86_64/corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.2.C30mdk.x86_64.rpm
23ccbc4b1d1572a0bda25c8497a83a5d x86_64/corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.2.C30mdk.x86_64.rpm
3ae747ee09d81dcceb435032db500c41 x86_64/corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.2.C30mdk.x86_64.rpm
178e7551a893522351cdb633b3a251ff x86_64/corporate/3.0/RPMS/mozilla-irc-1.7.8-0.2.C30mdk.x86_64.rpm
1431f59d6dfaabfcf9c74f0e52f30527 x86_64/corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.2.C30mdk.x86_64.rpm
996537a7b1b60bbe53557a1da658470a x86_64/corporate/3.0/RPMS/mozilla-mail-1.7.8-0.2.C30mdk.x86_64.rpm
d95814a734933529dd23656837e080f9 x86_64/corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.2.C30mdk.x86_64.rpm
2a768ee57f740885cf246a9e466c1b71 x86_64/corporate/3.0/SRPMS/mozilla-1.7.8-0.2.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFC8GeZmqjQ0CJFipgRAivVAKCNvYuAeAB+Ygiwc5aq2P5mZmAotACg27oY
FjcBIx8uWUD+ikThITCswII=
=4AU1
-----END PGP SIGNATURE-----
