Mozilla Firefox up to 1.4 Javascript Engine jsxml.c GetNewOrUsed resource management
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
9.0 | $0-$5k | 0.00 |
A vulnerability classified as critical was found in Mozilla Firefox up to 1.4 (Web Browser). This vulnerability affects the function nsNPObjWrapper::GetNewOrUsed
of the file jsxml.c of the component Javascript Engine. The manipulation with an unknown input leads to a resource management vulnerability. The CWE definition for the vulnerability is CWE-399. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine and (1) misinterpretation of the characteristics of Namespace and QName in jsxml.c, (2) misuse of signed integers in the nsEscapeCount function in nsEscape.cpp, and (3) interaction of JavaScript garbage collection with certain use of an NPObject in the nsNPObjWrapper::GetNewOrUsed function in nsJSNPRuntime.cpp.
The weakness was disclosed 09/24/2008 by Georgi Guninski (moz_bug_r_a4) with Martijn Wargers (Website). The advisory is available at redhat.com. This vulnerability was named CVE-2008-4062 since 09/12/2008. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.
It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 43709 (CentOS 4 / 5 : firefox (CESA-2008:0879)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CentOS Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 165702 (SUSE Enterprise Linux Security Update Mozilla (SUSE-SA:2008:050)).
Upgrading to version 1.5 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 9130.
The vulnerability is also documented in the databases at X-Force (45355) and Tenable (43709). The entries 44216, 44189, 44188 and 44187 are pretty similar.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 10.0VulDB Meta Temp Score: 9.0
VulDB Base Score: 10.0
VulDB Temp Score: 9.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Proof-of-Concept
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 43709
Nessus Name: CentOS 4 / 5 : firefox (CESA-2008:0879)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 61770
OpenVAS Name: Debian Security Advisory DSA 1649-1 (iceweasel)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Upgrade: Firefox 1.5
TippingPoint: 🔍
Timeline
09/12/2008 🔍09/23/2008 🔍
09/24/2008 🔍
09/24/2008 🔍
09/24/2008 🔍
09/24/2008 🔍
09/24/2008 🔍
09/25/2008 🔍
01/06/2010 🔍
03/17/2015 🔍
08/17/2019 🔍
Sources
Vendor: mozilla.orgProduct: mozilla.org
Advisory: redhat.com
Researcher: Georgi Guninski (moz_bug_r_a4)
Organization: Martijn Wargers
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2008-4062 (🔍)
OVAL: 🔍
X-Force: 45355
SecurityTracker: 1020916
Vulnerability Center: 19558 - Mozilla Firefox, Thunderbird and SeaMonkey Unspecified Vulnerabilities Allow Code Execution or DoS, Medium
SecurityFocus: 31346 - Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
Secunia: 31984
OSVDB: 48751 - Mozilla Multiple Products nsJSNPRuntime.cpp nsNPObjWrapper::GetNewOrUsed Function Memory Corruption
Vupen: ADV-2008-2661
See also: 🔍
Entry
Created: 03/17/2015 16:11Updated: 08/17/2019 12:41
Changes: 03/17/2015 16:11 (80), 08/17/2019 12:41 (11)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.