|
|
| |
| The web browsers Mozilla Firefox, Mozilla Suite and Opera are vulnerable to local program execution allowing remote attackers to cause the program to execute arbitrary programs. |
| |
Credit:
The information has been provided by Secunia .
The original article can be found at: http://secunia.com/advisories/16869/
Mozilla Advisory can be found: http://www.mozilla.org/security/announce/mfsa2005-59.html
Mozilla bugzilla report can be found: https://bugzilla.mozilla.org/show_bug.cgi?id=307185
|
| |
Vulnerable Systems:
* Mozilla Firefox version 1.0.6
* Mozilla Suite version 1.7.10
* Opera version 8
Immune Systems:
* Opera version 8.51
* Mozilla Firefox version 1.0.7
* Mozilla suite 1.7.12
By opening Mozilla Firefox, Mozilla Suite or the Opera browser with back ticks (`) chars, it is possible to execute arbitrary programs on Linux and UNIX based systems, with the privileges of the running user.
Proof of Concept:
Firefox:
firefox http://local\`find\`host
Mozilla Suite:
mozilla http://local`df`host
CVE Information:
CAN-2005-2968
CERT Information:
http://www.kb.cert.org/vuls/id/914681
|
|
|
|
|
