Vulnerability Name:

CVE-2006-3677 (CCN-27981)

Assigned:2006-07-26
Published:2006-07-26
Updated:2018-10-18
Summary:Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.2 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
6.2 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-16
Vulnerability Consequences:Gain Access
References:Source: SGI
Type: UNKNOWN
20060703-01-P

Source: CCN
Type: Browser Fun Blog Thursday, July 27, 2006
MoBB #28: Mozilla Navigator Object

Source: MITRE
Type: CNA
CVE-2006-3677

Source: CCN
Type: RHSA-2006-0594
seamonkey security update (was mozilla)

Source: CCN
Type: RHSA-2006-0608
seamonkey security update

Source: CCN
Type: RHSA-2006-0609
seamonkey security update

Source: REDHAT
Type: Vendor Advisory
RHSA-2006:0609

Source: CCN
Type: RHSA-2006-0610
firefox security update

Source: CCN
Type: RHSA-2006-0611
thunderbird security update

Source: CCN
Type: SA19873
Mozilla Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
19873

Source: SECUNIA
Type: Patch, Vendor Advisory
21216

Source: CCN
Type: SA21229
Mozilla SeaMonkey Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
21229

Source: SECUNIA
Type: Vendor Advisory
21243

Source: SECUNIA
Type: Vendor Advisory
21246

Source: SECUNIA
Type: Vendor Advisory
21262

Source: SECUNIA
Type: Vendor Advisory
21269

Source: SECUNIA
Type: Vendor Advisory
21270

Source: SECUNIA
Type: Vendor Advisory
21336

Source: SECUNIA
Type: Vendor Advisory
21343

Source: SECUNIA
Type: Vendor Advisory
21361

Source: SECUNIA
Type: Vendor Advisory
21529

Source: SECUNIA
Type: Vendor Advisory
21532

Source: SECUNIA
Type: Vendor Advisory
21631

Source: SECUNIA
Type: Vendor Advisory
22066

Source: SECUNIA
Type: Vendor Advisory
22210

Source: GENTOO
Type: UNKNOWN
GLSA-200608-02

Source: CCN
Type: SECTRACK ID: 1016586
Mozilla Firefox Multiple Bugs Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016586

Source: CCN
Type: SECTRACK ID: 1016587
Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016587

Source: CCN
Type: ASA-2006-149
seamonkey security update (RHSA-2006-0608)

Source: CCN
Type: ASA-2006-151
firefox seamonkey and thunderbird security update (RHSA-2006-0609 RHSA-2006-0610 and RHSA-2006-0611)

Source: CCN
Type: ASA-2006-208
seamonkey security update (was mozilla) (RHSA-2006-0594)

Source: CCN
Type: ASA-2006-259
HP-UX Firefox Vulnerabilities

Source: CCN
Type: ASA-2007-097
HP-UX Running Firefox Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) (HPSBUX02153)

Source: CCN
Type: GLSA-200507-24
Mozilla Suite: Multiple vulnerabilities

Source: CCN
Type: GLSA-200608-02
Mozilla SeaMonkey: Multiple vulnerabilities

Source: CCN
Type: GLSA-200608-03
Mozilla Firefox: Multiple vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200608-03

Source: CCN
Type: US-CERT VU#670060
Mozilla fails to properly release JavaScript references

Source: CERT-VN
Type: Third Party Advisory, US Government Resource
VU#670060

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:143

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:145

Source: CCN
Type: MFSA 2006-45
Javascript navigator Object Vulnerability

Source: CONFIRM
Type: Vendor Advisory
http://www.mozilla.org/security/announce/2006/mfsa2006-45.html

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:048

Source: REDHAT
Type: Vendor Advisory
RHSA-2006:0594

Source: REDHAT
Type: Vendor Advisory
RHSA-2006:0608

Source: REDHAT
Type: Vendor Advisory
RHSA-2006:0610

Source: REDHAT
Type: Vendor Advisory
RHSA-2006:0611

Source: BUGTRAQ
Type: UNKNOWN
20060726 ZDI-06-025: Mozilla Firefox Javascript navigator Object Vulnerability

Source: BUGTRAQ
Type: UNKNOWN
20060727 rPSA-2006-0137-1 firefox

Source: HP
Type: UNKNOWN
SSRT061181

Source: BID
Type: UNKNOWN
19181

Source: CCN
Type: BID-19181
Mozilla Multiple Products Remote Vulnerabilities

Source: BID
Type: Patch
19192

Source: CCN
Type: BID-19192
Mozilla Firefox Javascript Navigator Object Remote Code Execution Vulnerability

Source: CCN
Type: USN-327-1
Firefox vulnerabilities

Source: CCN
Type: USN-327-2
Firefox regression

Source: CCN
Type: USN-354-1
Firefox vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-354-1

Source: CCN
Type: US-CERT Technical Cyber Security Alert TA06-208A
Mozilla Products Contain Multiple Vulnerabilities

Source: CERT
Type: US Government Resource
TA06-208A

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2998

Source: VUPEN
Type: Vendor Advisory
ADV-2006-3748

Source: VUPEN
Type: Vendor Advisory
ADV-2008-0083

Source: MISC
Type: Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-06-025.html

Source: XF
Type: UNKNOWN
mozilla-javascript-navigator-code-excecution(27981)

Source: XF
Type: UNKNOWN
mozilla-javascript-navigator-code-excecution(27981)

Source: XF
Type: UNKNOWN
iphone-mobilesafari-dos(39998)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-536

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10745

Source: UBUNTU
Type: UNKNOWN
USN-327-1

Source: CCN
Type: Rapid7 Vulnerability and Exploit Database [07-25-2006]
Mozilla Suite/Firefox Navigator Object Code Execution

Source: SUSE
Type: SUSE-SA:2006:048
Mozilla Firefox Thunderbird and Seamonkey security problems

Source: CCN
Type: ZDI-06-025
Mozilla Firefox Javascript navigator Object Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:dev:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:seamonkey:1.0::dev:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:-:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:5.10:*:*:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20063677
    V
    		CVE-2006-3677
    2015-11-16
    oval:org.mitre.oval:def:10745
    V
    		Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.
    2013-04-29
    oval:com.redhat.rhsa:def:20060609
    P
    		RHSA-2006:0609: seamonkey security update (Critical)
    2006-08-02
    oval:com.redhat.rhsa:def:20060611
    P
    		RHSA-2006:0611: thunderbird security update (Critical)
    2006-07-29
    oval:com.redhat.rhsa:def:20060610
    P
    		RHSA-2006:0610: firefox security update (Critical)
    2006-07-28
    oval:com.redhat.rhsa:def:20060608
    P
    		RHSA-2006:0608: seamonkey security update (Critical)
    2006-07-27
    BACK
    mozilla firefox 1.5
    mozilla firefox 1.5.0.1
    mozilla firefox 1.5.0.2
    mozilla firefox 1.5.0.3
    mozilla firefox 1.5.0.4
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0.1
    mozilla seamonkey 1.0.2
    mozilla seamonkey 1.0
    mozilla firefox 1.5
    mozilla firefox 1.5.0.2
    mozilla firefox 1.5.0.3
    mozilla firefox 1.5.0.4
    mozilla seamonkey 1.0.2
    mozilla seamonkey 1.0
    mozilla seamonkey 1.0.1
    mozilla firefox 1.5.0.1
    gentoo linux -
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux 9.2
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    canonical ubuntu 5.10
    novell suse linux 10.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 2006
    canonical ubuntu 6.06
    novell suse linux 10.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux corporate server 3.0
    suse suse linux 9.3