Vulnerability CVE-2007-6589 - CERT Civis.Net

Vulnerability Name:

CVE-2007-6589 (CCN-38356)

Assigned:

2007-11-07

Published:

2007-11-07

Updated:

2017-09-29

Summary:

The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Full-Disclosure Mailing List, Thu Nov 08 2007 - 18:16:45 CST
JAR: protocol vulnerability in Firefox, word processing applications reported

Source: MISC
Type: UNKNOWN
http://blog.beford.org/?p=8

Source: CCN
Type: Netscape Web site
Release Notes: What's New in Netscape Navigator 9.0.0.4

Source: MITRE
Type: CNA
CVE-2007-5947

Source: MITRE
Type: CNA
CVE-2007-6589

Source: HP
Type: UNKNOWN
SSRT061181

Source: OSVDB
Type: UNKNOWN
43477

Source: CCN
Type: RHSA-2007-1082
Critical: firefox security update

Source: CCN
Type: RHSA-2007-1083
Moderate: thunderbird security update

Source: CCN
Type: RHSA-2007-1084
Critical: seamonkey security update

Source: CCN
Type: SA27605
Mozilla Firefox "jar:" Protocol Handling Cross-Site Scripting Security Issue

Source: CCN
Type: SA27800
Netscape Multiple Vulnerabilities

Source: CCN
Type: SA27816
SeaMonkey Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1018928
Mozilla Firefox Input Validation Hole in jar: Protocol Handler Permits Cross-Site Scripting Attacks

Source: CCN
Type: Sun Alert ID: 231441
Multiple Security Vulnerabilities in Solaris 10 Firefox and Thunderbird

Source: CCN
Type: ASA-2007-492
seamonkey security update (RHSA-2007-1084)

Source: CCN
Type: ASA-2007-494
Firefox security update (RHSA-2007-1082)

Source: CCN
Type: ASA-2007-536
thunderbird security update (RHSA-2007-1083)

Source: CCN
Type: ASA-2008-085
Multiple Security Vulnerabilities in Solaris 10 Firefox and Thunderbird (Sun 231441)

Source: DEBIAN
Type: DSA-1424
iceweasel -- several vulnerabilities

Source: DEBIAN
Type: DSA-1425
xulrunner -- several vulnerabilities

Source: CCN
Type: GLSA-200712-21
Mozilla Firefox, SeaMonkey: Multiple vulnerabilities

Source: CCN
Type: GNUCITIZEN Blog, November 7th, 2007
Web Mayhem: Firefoxs JAR: Protocol issues

Source: CCN
Type: US-CERT VU#715737
Mozilla-based browsers jar: URI cross-site scripting vulnerability

Source: CCN
Type: MFSA 2007-37
jar: URI scheme XSS hazard

Source: CONFIRM
Type: UNKNOWN
http://www.mozilla.org/security/announce/2007/mfsa2007-37.html

Source: CCN
Type: OSVDB ID: 43477
Mozilla Multiple Browsers jar: Protocol Handler inner URI HTTP Redirect XSS

Source: CCN
Type: BID-26385
Mozilla Firefox Jar URI Cross-Site Scripting Vulnerability

Source: CCN
Type: USN-546-1
Firefox vulnerabilities

Source: CCN
Type: USN-546-2
Firefox regression

Source: VUPEN
Type: UNKNOWN
ADV-2008-0083

Source: CCN
Type: Bugzilla@Mozilla - Bug 369814
(jarxss) - jar: protocol is an XSS hazard due to ignoring mime type and being considered same-origin with hosting site

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=369814

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=403331

Source: XF
Type: UNKNOWN
firefox-jar-uri-xss(38356)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6033

Source: SUSE
Type: SUSE-SA:2007:066
Mozilla Firefox security update

Vulnerable Configuration:

Configuration 1:

cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version <= 2.0.0.9)

OR cpe:/a:mozilla:seamonkey:*:*:*:*:*:*:*:* (Version <= 1.1.6)

Configuration CCN 1:

cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*

AND

cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*

OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*

OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:turbolinux:turbolinux:fuji:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*

OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4.5.z::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4.5.z::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4.6.z:ga:as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4.6.z:ga:es:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:6033	V	HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS)	2014-03-24