The following cyber advisory was issued by the New York State Office of Information Technology Services and is
intended for State government entities. The information may or may not be applicable to the
general public and, accordingly, the State does not warrant its use for any specific purposes.
ITS ADVISORY NUMBER:
2012-008
DATE(S) ISSUED:
02/14/2012
SUBJECT:
Vulnerability in Mozilla Products Could Allow Remote Code Execution
OVERVIEW:
A vulnerability has been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey applications, which could allow remote code execution. Mozilla Firefox is a web browser used to access the Internet. Mozilla Thunderbird is an e-mail client. Mozilla SeaMonkey is a cross platform Internet suite of tools ranging from a web browser to an e-mail client. Successful exploitation of these vulnerabilities could result in either an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights.
SYSTEMS AFFECTED:
- Firefox versions 10.x prior to 10.0.1
- Thunderbird versions 10.x prior to 10.0.1
- SeaMonkey version 2.7
RISK:
Government:
- Large and medium government entities: High
- Small government entities: High
Businesses:
- Large and medium business entities: High
- Small business entities: High
Home users: High
DESCRIPTION:
A vulnerability has been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. The details of this vulnerability are as follows:
Use after free error in nsXBLDocumentInfo::ReadPrototypeBindings
Mozilla found that ReadPrototypeBindings will leave a XBL binding in a hash table even when the function fails. If this occurs, when the cycle collector reads this hash table and attempts to do a virtual method on this binding a crash will occur. Successful exploitation of this vulnerability may allow execution of arbitrary code.
RECOMMENDATIONS:
We recommend the following actions be taken:
- Upgrade vulnerable Mozilla products to the latest version immediately after appropriate testing.
- Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
- Remind users not to open e-mail attachments from unknown users or suspicious e-mails from trusted sources.
- Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
REFERENCES:
Mozilla:
https://www.mozilla.org/security/announce/2012/mfsa2012-10.html
CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0452
Secunia:
http://secunia.com/advisories/48008/
