Note: This is an archival copy of Security Sun Alert 231441 as previously published on http://sunsolve.sun.com. Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1018977.1. |
Category Security Release Phase Resolved 6644698 Date of Workaround Release 08-Feb-2008 Date of Resolved Release 12-Feb-2008 Multiple Security Vulnerabilities in Solaris 10 Firefox and Thunderbird 1. Impact
Multiple security vulnerabilities in the firefox(1) and thunderbird(1)
applications shipped with Solaris 10 may allow a local or remote
unprivileged user to execute arbitrary code on a remote machine with
the privileges of a local user, cause firefox(1) and thunderbird(1)
applications to crash, or conduct Cross-Site Scripting (XSS) attacks on
sites which allow users to upload pictures, archives, or other files.
The ability to crash the firefox(1) or thunderbird(1) application is a
type of Denial of Service (DoS).The following Mozilla advisories describe the vulnerabilities: http://www.mozilla.org/security/announce/2007/mfsa2007-39.html
http://www.mozilla.org/security/announce/2007/mfsa2007-38.html http://www.mozilla.org/security/announce/2007/mfsa2007-37.html http://www.mozilla.org/security/announce/2007/mfsa2007-29.html Additional references: CVE-2007-5960 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960
CVE-2007-5959 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959 CVE-2007-5947 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947 CVE-2007-5339 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5339 CVE-2007-5340 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5340 CERT VU# 715737 at http://www.kb.cert.org/vuls/id/715737 CERT VU#559977 at http://www.kb.cert.org/vuls/id/559977 CERT VU#755513 at http://www.kb.cert.org/vuls/id/755513 The issues described in mfsa2007-37, mfsa2007-38 and mfsa2007-39 affect Firefox only and are fixed in the Firefox patches listed in this Sun Alert. The following additional issue described in MFSA2007-29 impacts both Firefox and Thunderbird, but is described for Firefox in Sun Alert 201516 (previously 103177), and is described for Thunderbird in this Sun Alert. It is fixed in the Thunderbird patches listed in this Sun Alert. 2. Contributing FactorsThese issues can occur in the following releases:SPARC Platform
Note: Firefox and Thunderbird first shipped with Solaris 10 Update 4 (8/07). Firefox is shipped in the SUNWfirefox package and Thunderbird is shipped in the SUNWthunderbird package. To determine which update release has been installed on a Solaris 10 system, review the /etc/release file: $ cat /etc/release 3. SymptomsThere are no predictable symptoms that would indicate the described
issues have been exploited.4. WorkaroundTo work around the issues described in CVE-2007-5947, sites can use a proxy server or application firewall which blocks URIs that contain jar: URIs.To work around the issues described in CVE-2007-5339 and CVE-2007-5340, JavaScript can be disabled by doing the following:
5. ResolutionThis issue is addressed in the following releases:
This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2008 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. Modification History 12-Feb-2008: Updated Contributing Factors and Resolution sections, RESOLVED Product Firefox 2.0 Solaris 10 Operating System References125540-03125539-03 125541-02 125542-02 Attachments This solution has no attachment |
|