PT-2005-2473 · Mozilla+1 · Firefox+1

Alanjstr + 21 · Published 2005-05-09 · Updated 2017-10-11 · CVE-2005-1477

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3

Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site.

Recommendations: For Firefox version 1.0.3, consider restricting access to the install function until a patch is available. As a temporary workaround, avoid using the javascript: URL scheme for package icons to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1477

RHSA-2005:434

RHSA-2005:435

RHSA-2005_434

RHSA-2005_435

Affected Products

Firefox

Red Hat

References · 27

• 🔥 https://exploit-db.com/exploits/986 · Exploit
• 🔥 http://greyhatsecurity.org/firefox.htm · Exploit
• 🔥 http://greyhatsecurity.org/vulntests/ffrc.htm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1477 · Security Note
• http://redhat.com/support/errata/RHSA-2005-434.html · Vendor Advisory
• http://secunia.com/advisories/15292 · Patch
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-435.html · Vendor Advisory
• http://kb.cert.org/vuls/id/648758 · Note
• http://securitytracker.com/id?1013913 · Note
• http://marc.info/?l=full-disclosure&m=111553138007647&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100001 · Note
• https://rhn.redhat.com/errata/RHSA-2005-435.html · Note
• https://redhat.com/security/data/cve/CVE-2005-1476.html · Note
• https://redhat.com/security/data/cve/CVE-2005-1531.html · Note