Vulnerability CVE-2006-2900 - CERT Civis.Net

Vulnerability Name:

CVE-2006-2900 (CCN-31468)

Assigned:

2006-06-05

Published:

2006-06-05

Updated:

2011-10-11

Summary:

Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.

CVSS v3 Severity:

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.3 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
2.1 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: CCN
Type: Full-Disclosure Mailing List, Mon Jun 05 2006 - 12:17:08 CDT
file upload widgets in IE and Firefox have issues

Source: CCN
Type: Full-Disclosure Mailing List, Sun Feb 11 2007 - 14:00:45 CST
Firefox focus stealing vulnerability (possibly other browsers)

Source: CCN
Type: Full-Disclosure Mailing List, Mon Jul 02 2007 - 04:01:45 CDT
New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

Source: MITRE
Type: CNA
CVE-2006-2894

Source: MITRE
Type: CNA
CVE-2006-2900

Source: CCN
Type: BUGTRAQ, Mon, 12 Feb 2007 00:34:46 +0100
MSIE, Firefox focus stealing vulnerabilities (updated for BUGTRAQ)

Source: FULLDISC
Type: UNKNOWN
20060605 file upload widgets in IE and Firefox have issues

Source: CCN
Type: SA20442
Firefox File Upload Form Keystroke Event Cancel Vulnerability

Source: CCN
Type: SA20449
Internet Explorer File Upload Form Keystroke Event Cancel Vulnerability

Source: SECUNIA
Type: Vendor Advisory
20449

Source: CCN
Type: SA20467
Mozilla Suite File Upload Form Keystroke Event Cancel Vulnerability

Source: CCN
Type: SA20470
Netscape File Upload Form Keystroke Event Cancel Vulnerability

Source: CCN
Type: SA20472
Mozilla SeaMonkey File Upload Form Keystroke Event Cancel Vulnerability

Source: SREASON
Type: UNKNOWN
1059

Source: CCN
Type: SECTRACK ID: 1018837
Mozilla Firefox May Discloses Files or Information to Remote Users

Source: CCN
Type: ASA-2008-008
Multiple Security Vulnerabilities in Firefox and Thunderbird for Solaris 10 May Allow Execution of Arbitrary Code and Access to Unauthorized Data (Sun 103177)

Source: DEBIAN
Type: DSA-1392
xulrunner -- several vulnerabilities

Source: DEBIAN
Type: DSA-1396
iceweasel -- several vulnerabilities

Source: DEBIAN
Type: DSA-1401
iceape -- several vulnerabilities

Source: CCN
Type: Microsoft Internet Explorer Web site
Internet Explorer: Home Page

Source: CCN
Type: MFSA 2007-32
File input focus stealing vulnerability

Source: CCN
Type: OSVDB ID: 26178
Multiple Multiple Browsers OnKey* Keystroke Event File Upload

Source: BID
Type: UNKNOWN
18308

Source: CCN
Type: BID-18308
Multiple Vendor Web Browser JavaScript Key Filtering Vulnerability

Source: CCN
Type: USN-535-1
Firefox vulnerabilities

Source: CCN
Type: USN-536-1
Thunderbird vulnerabilities

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2161

Source: XF
Type: UNKNOWN
browser-keystroke-information-disclosure(31468)

Source: SUSE
Type: SUSE-SA:2007:057
Mozilla Security Update

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:ie:5.01:windows_2000_sp4:*:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:*:windows_xp_professional_64bit:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:sp1:windows_98:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:sp1:windows_98_se:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:sp1:windows_millennium:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:sp1:windows_xpsp1:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:windows_2000_sp4:*:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:windows_server_2003_sp1_itanium:*:*:*:*:*:*

OR cpe:/a:microsoft:ie:6:windows_xp_sp2:*:*:*:*:*:*

OR cpe:/h:canon:network_camera_server_vb101:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*

OR cpe:/a:netscape:navigator:8.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla_suite:1.7.13:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1::beta:*:*:*:*:*

AND

cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*

OR cpe:/a:suse:suse_linux_school_server:-:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*

OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*

OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*

OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

Denotes that component is vulnerable