Vulnerability Name:

CVE-2006-2894 (CCN-31468)

Assigned:2006-06-05
Published:2006-06-05
Updated:2018-10-18
Summary:Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.3 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
2.1 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Obtain Information
References:Source: BUGTRAQ
Type: UNKNOWN
20070211 Firefox focus stealing vulnerability (possibly other browsers)

Source: BUGTRAQ
Type: UNKNOWN
20070212 Re: [Full-disclosure] Firefox focus stealing vulnerability (possibly other browsers)

Source: CCN
Type: Full-Disclosure Mailing List, Mon Jun 05 2006 - 12:17:08 CDT
file upload widgets in IE and Firefox have issues

Source: CCN
Type: Full-Disclosure Mailing List, Sun Feb 11 2007 - 14:00:45 CST
Firefox focus stealing vulnerability (possibly other browsers)

Source: CCN
Type: Full-Disclosure Mailing List, Mon Jul 02 2007 - 04:01:45 CDT
New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

Source: MITRE
Type: CNA
CVE-2006-2894

Source: MITRE
Type: CNA
CVE-2006-2900

Source: HP
Type: UNKNOWN
HPSBUX02153

Source: MISC
Type: UNKNOWN
http://lcamtuf.coredump.cx/focusbug/

Source: CCN
Type: BUGTRAQ, Mon, 12 Feb 2007 00:34:46 +0100
MSIE, Firefox focus stealing vulnerabilities (updated for BUGTRAQ)

Source: FULLDISC
Type: Exploit
20060605 file upload widgets in IE and Firefox have issues

Source: FULLDISC
Type: UNKNOWN
20070211 Firefox focus stealing vulnerability (possibly other browsers)

Source: CCN
Type: SA20442
Firefox File Upload Form Keystroke Event Cancel Vulnerability

Source: SECUNIA
Type: Vendor Advisory
20442

Source: CCN
Type: SA20449
Internet Explorer File Upload Form Keystroke Event Cancel Vulnerability

Source: CCN
Type: SA20467
Mozilla Suite File Upload Form Keystroke Event Cancel Vulnerability

Source: SECUNIA
Type: Vendor Advisory
20467

Source: CCN
Type: SA20470
Netscape File Upload Form Keystroke Event Cancel Vulnerability

Source: SECUNIA
Type: Vendor Advisory
20470

Source: CCN
Type: SA20472
Mozilla SeaMonkey File Upload Form Keystroke Event Cancel Vulnerability

Source: SECUNIA
Type: Vendor Advisory
20472

Source: SECUNIA
Type: Vendor Advisory
21532

Source: SECUNIA
Type: Vendor Advisory
27298

Source: SECUNIA
Type: Vendor Advisory
27335

Source: SECUNIA
Type: Vendor Advisory
27383

Source: SECUNIA
Type: Vendor Advisory
27387

Source: SECUNIA
Type: Vendor Advisory
27403

Source: SECUNIA
Type: Vendor Advisory
27414

Source: SREASON
Type: UNKNOWN
1059

Source: CCN
Type: SECTRACK ID: 1018837
Mozilla Firefox May Discloses Files or Information to Remote Users

Source: SECTRACK
Type: UNKNOWN
1018837

Source: SUNALERT
Type: UNKNOWN
201516

Source: CCN
Type: ASA-2008-008
Multiple Security Vulnerabilities in Firefox and Thunderbird for Solaris 10 May Allow Execution of Arbitrary Code and Access to Unauthorized Data (Sun 103177)

Source: CONFIRM
Type: UNKNOWN
http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html

Source: DEBIAN
Type: DSA-1392
xulrunner -- several vulnerabilities

Source: DEBIAN
Type: DSA-1396
iceweasel -- several vulnerabilities

Source: DEBIAN
Type: DSA-1401
iceape -- several vulnerabilities

Source: MISC
Type: UNKNOWN
http://www.gnucitizen.org/blog/browser-focus-rip

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2007:202

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:143

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:145

Source: CCN
Type: Microsoft Internet Explorer Web site
Internet Explorer: Home Page

Source: CCN
Type: MFSA 2007-32
File input focus stealing vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html

Source: SUSE
Type: UNKNOWN
SUSE-SA:2007:057

Source: CCN
Type: OSVDB ID: 26178
Multiple Multiple Browsers OnKey* Keystroke Event File Upload

Source: BUGTRAQ
Type: UNKNOWN
20071026 rPSA-2007-0225-1 firefox

Source: BUGTRAQ
Type: UNKNOWN
20071029 FLEA-2007-0062-1 firefox

Source: BUGTRAQ
Type: UNKNOWN
20071029 rPSA-2007-0225-2 firefox thunderbird

Source: BID
Type: UNKNOWN
18308

Source: CCN
Type: BID-18308
Multiple Vendor Web Browser JavaScript Key Filtering Vulnerability

Source: MISC
Type: UNKNOWN
http://www.thanhngan.org/fflinuxversion.html

Source: CCN
Type: USN-535-1
Firefox vulnerabilities

Source: CCN
Type: USN-536-1
Thunderbird vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-536-1

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2160

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2162

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2163

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2164

Source: VUPEN
Type: Vendor Advisory
ADV-2007-3544

Source: VUPEN
Type: Vendor Advisory
ADV-2008-0083

Source: MISC
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=290478

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=370092

Source: MISC
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=56236

Source: XF
Type: UNKNOWN
browser-keystroke-information-disclosure(31468)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-1858

Source: UBUNTU
Type: UNKNOWN
USN-535-1

Source: FEDORA
Type: UNKNOWN
FEDORA-2007-2664

Source: SUSE
Type: SUSE-SA:2007:057
Mozilla Security Update

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version <= 2.0.0.8)
  • OR cpe:/a:mozilla:mozilla_suite:1.7.13:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:*:*:*:*:*:*:*:* (Version <= 1.1.4)
  • OR cpe:/a:netscape:navigator:*:*:*:*:*:*:*:* (Version <= 8.1)

    • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:netscape:navigator:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla_suite:1.7.13:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1::beta:*:*:*:*:*
  • AND
  • cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/a:suse:suse_linux_school_server:-:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*
  • OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20062894
    V
    		CVE-2006-2894
    2015-11-16
    oval:org.mitre.oval:def:17494
    P
    		USN-536-1 -- mozilla-thunderbird, thunderbird vulnerabilities
    2014-07-21
    oval:org.mitre.oval:def:17091
    P
    		USN-535-1 -- firefox vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:20376
    P
    		DSA-1396-1 iceweasel
    2014-06-23
    oval:org.mitre.oval:def:18602
    P
    		DSA-1401-1 iceape - several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:19745
    P
    		DSA-1392-1 xulrunner - several vulnerabilities
    2014-06-23
    BACK
    mozilla firefox 1.5.0.4
    mozilla firefox *
    mozilla mozilla suite 1.7.13
    mozilla seamonkey 1.0.2
    mozilla seamonkey *
    netscape navigator *
    microsoft ie 6.0
    mozilla firefox 2.0
    netscape navigator 8.1
    mozilla mozilla suite 1.7.13
    mozilla firefox 1.5.0.4
    mozilla seamonkey 1.0.2
    mozilla firefox 2.0.0.1
    mozilla firefox 2.0.0.2
    mozilla firefox 2.0.0.3
    mozilla firefox 2.0.0.4
    mozilla firefox 2.0.0.5
    mozilla seamonkey 1.1.3
    mozilla firefox 2.0.0.6
    mozilla seamonkey 1.1.2
    mozilla seamonkey 1.1.1
    mozilla firefox 2.0.0.7
    mozilla seamonkey 1.1.4
    mozilla firefox 2.0.0.8
    mozilla firefox 2.0 beta1
    mozilla firefox 2.0 rc2
    mozilla firefox 2.0 rc3
    mozilla seamonkey 1.1
    mozilla seamonkey 1.1
    suse linux enterprise server 8
    suse suse linux school server -
    mandrakesoft mandrake linux corporate server 3.0
    novell linux desktop 9
    novell open enterprise server *
    suse suse linux 10.0
    mandrakesoft mandrake linux 2006
    canonical ubuntu 6.06
    suse suse linux 10.1
    mandrakesoft mandrake linux 2006
    novell suse linux enterprise server 10 sp2
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2008.0
    debian debian linux 4.0
    canonical ubuntu 7.04
    canonical ubuntu 7.10
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2007.1
    novell open enterprise server *
    novell opensuse 10.2
    novell opensuse 10.3