AusCERT - AU-2007.0021 -- AusCERT Update - [Win][OSX] - Firefox 2.0.0.7 released addressing QuickTime browser integration vulnerability

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
AU-2007.0021 -- AusCERT Update - [Win][OSX] - Firefox 2.0.0.7 released addressing QuickTime browser integration vulnerability
Date: 19 September 2007
References: AL-2007.0111

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

AusCERT Update AU-2007.0021 - [Win][OSX]
Firefox 2.0.0.7 released addressing QuickTime browser integration vulnerability
19 September 2007

        AusCERT Update Summary
        ----------------------

Product:              Firefox 2.0.0.6 and prior
                      SeaMonkey 1.1.4 and prior
Publisher:            Mozilla Foundation
Operating System:     Windows
                      Mac OS X
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-4965

Ref:                  AL-2007.0111

Original Bulletin:    
  http://www.mozilla.org/security/announce/2007/mfsa2007-28.html

Comment: This new Firefox release mitigates the vulnerability previously
         reported in AusCERT Alert AL-2007.0111.
         
         An updated version of Mozilla SeaMonkey is not yet available
         at this point.

- --------------------------BEGIN INCLUDED TEXT--------------------

Mozilla Foundation Security Advisory 2007-28

   Title:     Code execution via QuickTime Media-link files
   Impact:    Critical
   Announced: September 18, 2007
   Reporter:  Petko D. Petkov
   Products:  Firefox, SeaMonkey
   Fixed in:  Firefox 2.0.0.7
   
Description
   
   On his blog Petko D. Petkov reported that QuickTime Media-Link files contain
   a qtnext attribute that could be used on Windows systems to launch the
   default browser with arbitrary command-line options. When the default
   browser is Firefox 2.0.0.6 or earlier use of the -chrome option allowed a
   remote attacker to run script commands with the full privileges of the
   user. This could be used to install malware, steal local data, or otherwise
   corrupt the victim's computer.
   
   The fix for MFSA 2007-23 was intended to prevent this type of attack but
   QuickTime calls the browser in an unexpected way that bypasses that fix.
   To protect Firefox users from this problem we have now eliminated the
   ability to run arbitrary script from the command-line. Other command-line
   options remain, however, and QuickTime Media-link files could still be
   used to annoy users with popup windows and dialogs until this issue is
   fixed in QuickTime.
   
   This QuickTime issue appears to be the one described by CVE-2006-4965 but
   the fix Apple applied in QuickTime 7.1.5 does not prevent this version of
   the problem.

Workaround
   
   Disabling JavaScript in the browser does not protect against this attack;
   prior to the fix scripts passed through the -chrome option would be executed
   regardless of the JavaScript setting for web content, much as interpreters
   for languages such as perl and Python execute scripts passed on the command
   line. The NoScript add-on, however, has provided protection against this
   class of attack since the cross-browser vulnerabilities described by MFSA
   2007-23 were discovered.

References
   
   * https://bugzilla.mozilla.org/show_bug.cgi?id=395942

   * CVE-2006-4965
     http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4965

   * "QuickTime pwns Firefox" (GNUCITIZEN blog)
     http://www.gnucitizen.org/blog/0day-quicktime-pwns-firefox

   * About the security content of QuickTime 7.1.5
     http://docs.info.apple.com/article.html?artnum=305149

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRvBz3Sh9+71yA2DNAQI/uAP+K7ZuhpYoK8+xgCZAw+fIGElJ9ERqT5ES
aA9+Ij/fPYqCnjsVroIuevU0xKY3usvz1GrayZEGgnxFFrdWYSXlxSQ2OwB9aTRO
8F/8Rs+YaBEvHKj53rI83K3YZyIyjlnLSoN67xPwfKswTZ9ZQUaF2KwztB+YUwgl
jvNztUSJtgU=
=5zbB
-----END PGP SIGNATURE-----