Vulnerability Name:

CVE-2008-1241 (CCN-41454)

Assigned:2008-03-25
Published:2008-03-25
Updated:2018-10-11
Summary:GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.4 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-59
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-1241

Source: SUSE
Type: UNKNOWN
SUSE-SA:2008:019

Source: CCN
Type: RHSA-2008-0207
Critical: firefox security update

Source: CCN
Type: RHSA-2008-0208
Critical: seamonkey security update

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0208

Source: CCN
Type: RHSA-2008-0209
Moderate: thunderbird security update

Source: SECUNIA
Type: UNKNOWN
29391

Source: CCN
Type: SA29526
Mozilla Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
29526

Source: SECUNIA
Type: UNKNOWN
29539

Source: SECUNIA
Type: UNKNOWN
29541

Source: CCN
Type: SA29547
Mozilla SeaMonkey Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
29547

Source: SECUNIA
Type: UNKNOWN
29550

Source: SECUNIA
Type: UNKNOWN
29558

Source: SECUNIA
Type: UNKNOWN
29560

Source: SECUNIA
Type: UNKNOWN
29607

Source: SECUNIA
Type: UNKNOWN
29616

Source: SECUNIA
Type: UNKNOWN
29645

Source: SECUNIA
Type: UNKNOWN
30327

Source: CCN
Type: SA30620
Sun Solaris Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
30620

Source: CCN
Type: SECTRACK ID: 1019700
Mozilla Firefox XUL Popup Bug Lets Remote Users Spoof Tabbed Pages

Source: SUNALERT
Type: UNKNOWN
238492

Source: CCN
Type: Sun Alert ID: 238492
Multiple Security Vulnerabilities in Solaris 10 Firefox may Allow Execution of Arbitrary Code and Access to Unauthorized Data

Source: CCN
Type: ASA-2008-142
firefox security update (RHSA-2008-0207)

Source: CCN
Type: ASA-2008-143
seamonkey security update (RHSA-2008-0208)

Source: CCN
Type: ASA-2008-146
thunderbird security update (RHSA-2008-0209)

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128

Source: DEBIAN
Type: UNKNOWN
DSA-1532

Source: DEBIAN
Type: UNKNOWN
DSA-1534

Source: DEBIAN
Type: UNKNOWN
DSA-1535

Source: DEBIAN
Type: DSA-1532
xulrunner -- several vulnerabilities

Source: DEBIAN
Type: DSA-1534
iceape -- several vulnerabilities

Source: DEBIAN
Type: DSA-1535
iceweasel -- several vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200805-18

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2008:080

Source: CCN
Type: MFSA 2008-19
XUL popup spoofing variant (cross-tab popups)

Source: CONFIRM
Type: UNKNOWN
http://www.mozilla.org/security/announce/2008/mfsa2008-19.html

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0207

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0209

Source: BUGTRAQ
Type: UNKNOWN
20080327 rPSA-2008-0128-1 firefox

Source: BID
Type: UNKNOWN
28448

Source: CCN
Type: BID-28448
Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.12 Multiple Remote Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1019700

Source: CCN
Type: USN-592-1
Firefox vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-592-1

Source: CERT
Type: US Government Resource
TA08-087A

Source: VUPEN
Type: UNKNOWN
ADV-2008-0998

Source: VUPEN
Type: UNKNOWN
ADV-2008-1793

Source: XF
Type: UNKNOWN
firefox-xul-popup-spoofing(41454)

Source: XF
Type: UNKNOWN
firefox-xul-popup-spoofing(41454)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11163

Source: SUSE
Type: SUSE-SA:2008:019
Mozilla Firefox security update

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version <= 2.0.0.12)
  • OR cpe:/a:mozilla:seamonkey:*:*:*:*:*:*:*:* (Version <= 1.1.8)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/a:redhat:rhel_productivity:5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:seamonkey:1.1::beta:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:novell:suse_linux_enterprise_server:10:sp2:itanium_ia64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.04:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:7.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007.1::x86-64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.6.z:ga:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.6.z:ga:es:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20081241
    V
    		CVE-2008-1241
    2022-06-30
    oval:org.opensuse.security:def:113434
    P
    		seamonkey-2.53.9.1-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106835
    P
    		seamonkey-2.53.9.1-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.mitre.oval:def:17694
    P
    		USN-592-1 -- firefox vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:20297
    P
    		DSA-1535-1 iceweasel
    2014-06-23
    oval:org.mitre.oval:def:7869
    P
    		DSA-1534 iceape -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:18729
    P
    		DSA-1534-1 iceape
    2014-06-23
    oval:org.mitre.oval:def:7955
    P
    		DSA-1532 xulrunner -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:18755
    P
    		DSA-1532-1 xulrunner
    2014-06-23
    oval:org.mitre.oval:def:19906
    P
    		DSA-1534-2 iceape - regression
    2014-06-23
    oval:org.mitre.oval:def:7395
    P
    		DSA-1535 iceweasel -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:22699
    P
    		ELSA-2008:0209: thunderbird security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:22714
    P
    		ELSA-2008:0207: firefox security update (Critical)
    2014-05-26
    oval:org.mitre.oval:def:11163
    V
    		GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.
    2013-04-29
    oval:com.redhat.rhsa:def:20080209
    P
    		RHSA-2008:0209: thunderbird security update (Moderate)
    2008-04-03
    oval:org.debian:def:1535
    V
    		several vulnerabilities
    2008-03-30
    oval:org.debian:def:1534
    V
    		several vulnerabilities
    2008-03-28
    oval:com.redhat.rhsa:def:20080207
    P
    		RHSA-2008:0207: firefox security update (Critical)
    2008-03-27
    oval:com.redhat.rhsa:def:20080208
    P
    		RHSA-2008:0208: seamonkey security update (Critical)
    2008-03-27
    oval:org.debian:def:1532
    V
    		several vulnerabilities
    2008-03-27
    BACK
    mozilla firefox *
    mozilla seamonkey *
    mozilla firefox 2.0
    mozilla firefox 2.0.0.1
    mozilla firefox 2.0.0.2
    mozilla firefox 2.0.0.3
    mozilla firefox 2.0.0.4
    mozilla firefox 2.0.0.5
    mozilla seamonkey 1.1.3
    mozilla firefox 2.0.0.6
    mozilla firefox 2.0.0.9
    mozilla seamonkey 1.1.2
    mozilla seamonkey 1.1.1
    mozilla firefox 2.0.0.7
    mozilla seamonkey 1.1.4
    mozilla firefox 2.0.0.8
    mozilla seamonkey 1.1.5
    mozilla seamonkey 1.1.6
    mozilla firefox 2.0.0.11
    mozilla firefox 2.0.0.12
    mozilla firefox 2.0 beta1
    mozilla firefox 2.0 rc2
    mozilla firefox 2.0 rc3
    mozilla firefox 2.0.0.10
    mozilla seamonkey 1.1
    mozilla seamonkey 1.1.7
    mozilla seamonkey 1.1.8
    mozilla seamonkey 1.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    sun solaris 10
    sun solaris 10
    redhat linux advanced workstation 2.1
    canonical ubuntu 6.06
    novell suse linux enterprise server 10 sp2
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2007.1
    mandrakesoft mandrake linux 2008.0
    debian debian linux 4.0
    canonical ubuntu 7.04
    redhat enterprise linux 5
    canonical ubuntu 7.10
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2007.1
    redhat enterprise linux 4.6.z ga
    redhat enterprise linux 4.6.z ga
    novell opensuse 10.2
    novell opensuse 10.3