PT-2006-3703 · Mozilla+2 · Firefox+2

Paul Nickerson · Published 2006-06-02 · Updated 2018-10-18 · CVE-2006-2784

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 1.5.0.4

Description The issue allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested javascript: URLs. This would not cross privilege boundaries if the user installs malicious software from the attacker-controlled site.

Recommendations For versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the "Manual Install" button for plugin installation until a patch is applied. Restrict access to untrusted websites to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-2784

DSA-1118

DSA-1120

DSA-1134-1

HPSBUX02153

RHSA-2006:0578

RHSA-2006:0609

RHSA-2006:0610

RHSA-2006:0611

RHSA-2006_0609

RHSA-2006_0610

RHSA-2006_0611

Affected Products

Hp-Ux

Firefox

Red Hat

References · 209

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/mozilla_navigatorjava.rb · Exploit
• http://secunia.com/advisories/21324 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3656 · Security Note
• http://secunia.com/advisories/21269 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5747 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6589 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0994 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5462 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0995 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2894 · Security Note
• https://bdu.fstec.ru/vul/2015-09531 · Security Note
• https://usn.ubuntu.com/296-2 · Vendor Advisory
• http://secunia.com/advisories/22066 · Vendor Advisory