Vulnerability Name:

CVE-2005-2263 (CCN-21406)

Assigned:2005-07-12
Published:2005-07-12
Updated:2017-10-11
Summary:The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2005-2263

Source: CCN
Type: RHSA-2004-421
mozilla security update

Source: CCN
Type: RHSA-2005-586
firefox security update

Source: CCN
Type: RHSA-2005-587
mozilla security update

Source: CCN
Type: SA11978
Multiple Browsers Frame Injection Vulnerability

Source: CCN
Type: SA15601
Mozilla / Mozilla Firefox Frame Injection Vulnerability

Source: CCN
Type: SA16043
Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
16043

Source: CCN
Type: SA16059
Mozilla Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
16059

Source: CCN
Type: CIAC INFORMATION BULLETIN P-251
Mozilla Security Updates

Source: CCN
Type: CIAC INFORMATION BULLETIN P-252
Firefox Security Updates

Source: CIAC
Type: UNKNOWN
P-252

Source: DEBIAN
Type: UNKNOWN
DSA-810

Source: DEBIAN
Type: DSA-775
mozilla-firefox -- frame injection spoofing

Source: DEBIAN
Type: DSA-777
mozilla -- frame injection spoofing

Source: DEBIAN
Type: DSA-779
mozilla-firefox -- several vulnerabilities

Source: DEBIAN
Type: DSA-810
mozilla -- several vulnerabilities

Source: CCN
Type: GLSA-200407-15
Opera: Multiple spoofing vulnerabilities

Source: CCN
Type: GLSA-200507-14
Mozilla Firefox: Multiple vulnerabilities

Source: CCN
Type: Mozilla Firefox Download Web page
Firefox - Rediscover the web

Source: CCN
Type: Mozilla Suite Web page
Mozilla Suite- The All-in-One Internet Application Suite

Source: CCN
Type: MFSA 2005-48
Same-origin violation with InstallTrigger callback

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.mozilla.org/security/announce/mfsa2005-48.html

Source: SUSE
Type: UNKNOWN
SUSE-SR:2005:018

Source: SUSE
Type: UNKNOWN
SUSE-SA:2005:045

Source: REDHAT
Type: UNKNOWN
RHSA-2005:586

Source: REDHAT
Type: UNKNOWN
RHSA-2005:587

Source: BID
Type: UNKNOWN
14242

Source: CCN
Type: BID-14242
Mozilla Suite, Firefox And Thunderbird Multiple Vulnerabilities

Source: CCN
Type: BID-15495
SCO OpenServer Release 5.0.7 Maintenance Pack 4 Released - Multiple Vulnerabilities Fixed

Source: CCN
Type: USN-149-1
Firefox vulnerabilities

Source: CCN
Type: USN-149-2
Fixed Firefox packages for USN-149-1

Source: CCN
Type: USN-149-3
Ubuntu 4.10 update for Firefox vulnerabilities

Source: CCN
Type: USN-155-1
Mozilla vulnerabilities

Source: CCN
Type: USN-155-2
Updated Epiphany packages to match Mozilla security update

Source: CCN
Type: USN-155-3
Fixed mozilla locale packages

Source: VUPEN
Type: UNKNOWN
ADV-2005-1075

Source: MISC
Type: Exploit, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=293331

Source: FEDORA
Type: UNKNOWN
FLSA:160202

Source: XF
Type: UNKNOWN
mozilla-callback-code-execution(21406)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100010

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100016

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11629

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1281

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1311

Source: SUSE
Type: SUSE-SA:2004:030
apache2: remote DoS condition

Source: SUSE
Type: SUSE-SA:2004:031
cups: remote code execution

Source: SUSE
Type: SUSE-SA:2004:032
apache2: remote denial-of-service

Source: SUSE
Type: SUSE-SA:2004:033
gtk2 gdk-pixbuf: remote code execution

Source: SUSE
Type: SUSE-SA:2004:034
XFree86-libs xshared: remote command execution

Source: SUSE
Type: SUSE-SA:2004:035
samba: remote file disclosure

Source: SUSE
Type: SUSE-SA:2004:036
mozilla: various vulnerabilities

Source: SUSE
Type: SUSE-SA:2005:045
mozilla MozillaFirefox epiphany galeon: information leak

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20052263
    V
    		CVE-2005-2263
    2015-11-16
    oval:org.mitre.oval:def:11629
    V
    		The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.
    2013-04-29
    oval:org.mitre.oval:def:1311
    V
    		RHE4 Firefox InstallTrigger Callback Vulnerability
    2013-04-08
    oval:org.debian:def:779
    V
    		several vulnerabilities
    2013-01-21
    oval:org.mitre.oval:def:100010
    V
    		Firefox InstallTrigger Callback Vulnerability
    2007-05-09
    oval:org.mitre.oval:def:100016
    V
    		Mozilla Suite InstallTrigger Callback Vulnerability
    2007-05-09
    oval:org.mitre.oval:def:1281
    V
    		RHE3 Firefox InstallTrigger Callback Vulnerability
    2005-10-12
    oval:org.debian:def:810
    V
    		several vulnerabilities
    2005-09-13
    oval:com.redhat.rhsa:def:20050587
    P
    		RHSA-2005:587: mozilla security update (Important)
    2005-07-22
    oval:com.redhat.rhsa:def:20050586
    P
    		RHSA-2005:586: firefox security update (Important)
    2005-07-21
    BACK
    mozilla firefox 0.8
    mozilla firefox 0.9
    mozilla firefox 0.9 rc
    mozilla firefox 0.9.1
    mozilla firefox 0.9.2
    mozilla firefox 0.9.3
    mozilla firefox 0.10
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla firefox 1.0.1
    mozilla firefox 1.0.2
    mozilla firefox 1.0.3
    mozilla firefox 1.0.4
    mozilla mozilla 1.3
    mozilla mozilla 1.4
    mozilla mozilla 1.4 alpha
    mozilla mozilla 1.4.1
    mozilla mozilla 1.5
    mozilla mozilla 1.5 alpha
    mozilla mozilla 1.5 rc1
    mozilla mozilla 1.5 rc2
    mozilla mozilla 1.5.1
    mozilla mozilla 1.6
    mozilla mozilla 1.6 alpha
    mozilla mozilla 1.6 beta
    mozilla mozilla 1.7
    mozilla mozilla 1.7 alpha
    mozilla mozilla 1.7 beta
    mozilla mozilla 1.7 rc1
    mozilla mozilla 1.7 rc2
    mozilla mozilla 1.7 rc3
    mozilla mozilla 1.7.1
    mozilla mozilla 1.7.2
    mozilla mozilla 1.7.3
    mozilla mozilla 1.7.5
    mozilla mozilla 1.7.6
    mozilla mozilla 1.7.7
    mozilla mozilla 1.7.8
    mozilla mozilla 1.3
    mozilla mozilla 1.4
    mozilla mozilla 1.6
    mozilla mozilla 1.7 rc3
    mozilla firefox 0.8
    mozilla firefox 0.9 rc
    mozilla mozilla 1.7
    mozilla mozilla 1.7.1
    mozilla firefox 0.9.2
    mozilla firefox 0.9.1
    mozilla firefox 0.9.3
    mozilla mozilla 1.7.2
    mozilla mozilla 1.7.3
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla mozilla 1.7.5
    mozilla firefox 1.0.1
    mozilla firefox 1.0.2
    mozilla mozilla 1.7.6
    mozilla firefox 1.0.3
    mozilla mozilla 1.7.8
    mozilla firefox 1.0.4
    mozilla firefox 0.10
    mozilla firefox 0.9
    mozilla mozilla 1.4.1
    mozilla mozilla 1.4 alpha
    mozilla mozilla 1.5
    mozilla mozilla 1.5.1
    mozilla mozilla 1.5 alpha
    mozilla mozilla 1.5 rc1
    mozilla mozilla 1.5 rc2
    mozilla mozilla 1.6 alpha
    mozilla mozilla 1.6 beta
    mozilla mozilla 1.7.7
    mozilla mozilla 1.7 alpha
    mozilla mozilla 1.7 beta
    mozilla mozilla 1.7 rc1
    mozilla mozilla 1.7 rc2
    gentoo linux *
    suse suse linux 8.1
    suse linux enterprise server 8
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    suse suse linux 8.2
    suse suse linux 9.0
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux 9.1
    redhat enterprise linux 3
    suse suse linux 9.2
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    redhat linux advanced workstation 2.1
    suse linux enterprise server 9
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    suse suse linux 9.3