Vulnerability Description
The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leading to arbitrary code execution on the system when combined with vulnerabilities such as CVE-2005-1476, as demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | 1.0.3 |
References
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
- http://greyhatsecurity.org/firefox.htmExploit
- http://greyhatsecurity.org/vulntests/ffrc.htmExploit
- http://marc.info/?l=full-disclosure&m=111553138007647&w=2
- http://marc.info/?l=full-disclosure&m=111556301530553&w=2
- http://secunia.com/advisories/15292Patch
- http://securitytracker.com/id?1013913
- http://www.kb.cert.org/vuls/id/648758US Government Resource
- http://www.mozilla.org/security/announce/mfsa2005-42.html
- http://www.redhat.com/support/errata/RHSA-2005-434.html
- http://www.redhat.com/support/errata/RHSA-2005-435.html
- http://www.securityfocus.com/bid/13544
- http://www.securityfocus.com/bid/15495
- http://www.vupen.com/english/advisories/2005/0493
- https://bugzilla.mozilla.org/show_bug.cgi?id=292691
FAQ
What is CVE-2005-1477?
CVE-2005-1477 is a vulnerability with a CVSS score of 5.1 (MEDIUM). The install function in Firefox 1.0.3 allows remote web sites on the browser's whitelist, such as update.mozilla.org or addon.mozilla.org, to execute arbitrary Javascript with chrome privileges, leadi...
How severe is CVE-2005-1477?
CVE-2005-1477 has been rated MEDIUM with a CVSS base score of 5.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-1477?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox.