PT-2007-3292 · Mozilla · Firebug

Publicado 2007-04-11 · Atualizado 2018-10-16 · CVE-2007-1947

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firebug extension versions prior to 1.04

Description A cross-zone scripting issue exists due to the incorrect identification of anonymous JavaScript functions in the DOM templates used by the console.log function. This allows remote attackers to bypass zone restrictions, read arbitrary file:// URIs, or execute arbitrary code in the browser chrome by overwriting the toString function via a certain function declaration.

Recommendations For Firebug extension versions prior to 1.04, update to version 1.04 or later to resolve the issue. As a temporary workaround, consider disabling the console.log function until a patch is available. Restrict access to the browser chrome to minimize the risk of exploitation. Avoid using the toString function in sensitive contexts until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-1947

Produtos afetados

Firebug

Referências · 5

• 🔥 https://exploit-db.com/exploits/29820 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1947 · Nota de Segurança
• http://securityfocus.com/archive/1/464875/100/0/threaded · Nota
• http://larholm.com/2007/04/06/more-0day-in-firebug · Aviso do Fabricante
• http://larholm.com/2007/04/06/more-0day-in-firebug/#comment-6 · Aviso do Fabricante