===================================================================== CERT-Renater Note d'Information No. 2005/VULN187 _____________________________________________________________________ DATE : 16/03/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : systems running Mozilla Firefox. ====================================================================== ______________________________________________________________________________ SUSE Security Announcement Package: Mozilla Firefox Announcement-ID: SUSE-SA:2005:016 Date: Wed, 16 Mar 2005 13:00:00 +0000 Affected products: 9.0, 9.1, 9.2 Novell Linux Desktop 9 Vulnerability Type: remote code execution Severity (1-10): 7 SUSE default package: yes Cross References: CAN-2005-0231 CAN-2005-0232 CAN-2005-0233 CAN-2005-0255 Content of this advisory: 1) security vulnerability resolved: several vulnerabilities in Mozilla Firefox problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: See SUSE Security Summary Report. 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion This security update for Mozilla Firefox fixes following problems: - CAN-2005-0231: "Fire tabbing" The javascript security manager usually prevents that a javascript: URL from one host is opened in a window displaying content from another host. But when the link is dropped to a tab, the security manager does not kick in. This can lead to several security problems scaling from stealing session cookies to the ability to run arbitrary code on the client system (depending on the displayed site or security settings). - CAN-2005-0232: "Fire flashing" Using plugins like Flash and the -moz-opacity filter it is possible to display the about:config site in a hidden frame or a new window. By making the user double-click at a specific screen position (e.g. using a DHTML game) you can silently toggle the status of boolean config parameters. - CAN-2005-0233: "homograph attacks" / "IDN cloaking" Attackers may spoof host names by using translated host name representation which look exactly the same as the original host, allowing phishing attacks or similar. We now show both IDN punycode and visible form of the host name. - CAN-2005-0255: Attackers could cause overflows or crashes in low memory situations. - Added additional Firefox bugfixes from the 1.0.1 release. Only the listed distributions are affected, others do not ship Mozilla Firefox. Also note that Firefox was called Firebird in SUSE Linux 9.0. 2) solution/workaround Please install the updated packages. There is no workaround (except using a different browser). 3) special instructions and notes Make sure you restart the browser after installing the update. 4) package location and checksums Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. x86 Platform: SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/MozillaFirefox-1.0.1-9.1.i586.rpm 03340b9512cc1aef8dc2a100bf66631c SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/MozillaFirefox-1.0.1-9.1.i586.rpm 93d751acabec7807a9b0bc247c9084a3 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/MozillaFirefox-1.0.1-9.1.src.rpm 2af47975159426d15cc8c3e40b3877b5 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/MozillaFirebird-1.0.1-2.i586.rpm 4731ff8ce252e7535bb94e0d2998b125 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/MozillaFirebird-1.0.1-2.src.rpm 2f60d898cd6f8da2bb98e84d6f1a9a8f x86-64 Platform: SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/MozillaFirefox-1.0.1-9.1.x86_64.rpm ad04f06e87d2c681672d7264675daabf source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/MozillaFirefox-1.0.1-9.1.src.rpm 44be2cc4c2faae20063b0777b95fd8bd SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/MozillaFirefox-1.0.1-9.1.x86_64.rpm 63c8105d5b6cc13c38039f91da57ed12 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/MozillaFirefox-1.0.1-9.1.src.rpm 2a3dffc30e5e000bd9b52fb96cd280ce SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/MozillaFirebird-1.0.1-2.x86_64.rpm c4bfada21e489e50929b8036f50678c1 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/MozillaFirebird-1.0.1-2.src.rpm ea1efdfe7964b25d34954644e30f9817 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: See SUSE Security Summary Report. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security@suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig to verify the signature of the package, where is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build@suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security@suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to . suse-security-announce@suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to . For general information or the frequently asked questions (faq) send mail to: or respectively. ===================================================================== SUSE's security contact is or . @suse.de>. The public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================