PT-2008-5574 · Mozilla · Firefox

Aditya K Sood · Published 2008-09-29 · Updated 2018-10-11 · CVE-2008-4324

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 3.0.2 through 3.0.3

Description: The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via a series of keypress, click, onkeydown, onkeyup, onmousedown, and onmouseup events.

Recommendations: For Mozilla Firefox versions 3.0.2 through 3.0.3, consider disabling the user interface event dispatcher as a temporary workaround until a patch is available. Restrict access to the affected event handlers to minimize the risk of exploitation. Avoid triggering the series of keypress, click, onkeydown, onkeyup, onmousedown, and onmouseup events in the affected versions.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4324

Affected Products

Firefox

References · 10

• 🔥 https://exploit-db.com/exploits/6614 · Exploit
• 🔥 http://securityfocus.com/bid/31476 · Exploit
• 🔥 http://securityreason.com/securityalert/4321 · Exploit
• 🔥 http://secniche.org/moz303/index.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4324 · Security Note
• http://secunia.com/advisories/32040 · Vendor Advisory
• http://securityfocus.com/archive/1/496846/100/0/threaded · Note
• http://securityfocus.com/archive/1/496807/100/0/threaded · Note
• http://evilfingers.com/advisory/Firefox_User_Interface_Null_Pointer_Dereference_Dispatcher_Crash_n_Remote_DoS.php · Note
• http://secniche.org/moz303.html · Note