|
Firefox File Upload Form Keystroke Event Cancel Vulnerability
|
|
Secunia Advisory:
|
SA20442
|
|
|
Release Date:
|
2006-06-06
|
|
Last Update:
|
2007-10-19
|
|
Popularity:
|
35,660 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Mozilla Firefox 1.x
Mozilla Firefox 2.0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-2894
|
|
Description:
Charles McAuley has discovered a vulnerability in Firefox, which can be exploited by malicious people to trick users into disclosing sensitive information.
The vulnerability is caused due to a design error where a script can cancel certain keystroke events when entering text. This can be exploited to trick a user into typing a filename in a file upload input field by changing focus and canceling the "OnKeyPress" JavaScript event on certain characters.
Successful exploitation allows an arbitrary file on the user's system to be uploaded to a malicious web site, but requires that the user type text containing the characters of the filename.
The vulnerability is confirmed in version 1.5.0.4 and 2.0.0.1. Other versions may also be affected.
Solution:
Update to version 2.0.0.8.
Provided and/or discovered by:
Charles McAuley
Additional Information:
Michal Zalewski
NOTE: A variant of this vulnerability was reported in a Mozilla Bugzilla bug entry back in 2000.
Changelog:
2006-06-08: Added CVE reference.
2007-02-12: Added additional information that includes latest affected version based on research by Michal Zalewski.
2007-10-19: Updated "Solution" section. Added link to Mozilla Foundation.
Original Advisory:
Mozilla Foundation:
http://www.mozilla.org/security/announce/2007/mfsa2007-32.html
Charles McAuley:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
Other References:
Michal Zalewski:
http://lists.grok.org.uk/pipermail/full-disclosure/2007-February/052333.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
