firefox -- PLUGINSPAGE privileged javascript execution

Description:

A Mozilla Foundation Security Advisory reports:

When a webpage requires a plugin that is not installed the user can click to launch the Plugin Finder Service (PFS) to find an appropriate plugin. If the service does not have an appropriate plugin the EMBED tag is checked for a PLUGINSPAGE attribute, and if one is found the PFS dialog will contain a "manual install" button that will load the PLUGINSPAGE url.

Omar Khan reported that if the PLUGINSPAGE attribute contains a javascript: url then pressing the button could launch arbitrary code capable of stealing local data or installing malicious code.

Doron Rosenberg reported a variant that injects script by appending it to a malformed URL of any protocol.

References:

• CVE name CVE-2005-0752
• URL: <http://www.mozilla.org/security/announce/mfsa2005-34.html>
• URL: <https://bugzilla.mozilla.org/show_bug.cgi?id=288556>
• URL: <https://bugzilla.mozilla.org/show_bug.cgi?id=289171>

Affects:

• firefox <1.0.3,1
• linux-firefox <1.0.3

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Officer. Refer to "FreeBSD Security Information" for more information.