______________________________________________________________________________
SUSE Security Announcement
Package: Mozilla Firefox
Announcement-ID: SUSE-SA:2005:016
Date: Wed, 16 Mar 2005 13:00:00 +0000
Affected products: 9.0, 9.1, 9.2
Novell Linux Desktop 9
Vulnerability Type: remote code execution
Severity (1-10): 7
SUSE default package: yes
Cross References: CAN-2005-0231
CAN-2005-0232
CAN-2005-0233
CAN-2005-0255
Content of this advisory:
1) security vulnerability resolved:
several vulnerabilities in Mozilla Firefox
problem description
2) solution/workaround
3) special instructions and notes
4) package location and checksums
5) pending vulnerabilities, solutions, workarounds:
See SUSE Security Summary Report.
6) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion
This security update for Mozilla Firefox fixes following problems:
- CAN-2005-0231: "Fire tabbing"
The javascript security manager usually prevents that a javascript:
URL from one host is opened in a window displaying content from
another host. But when the link is dropped to a tab, the security
manager does not kick in.
This can lead to several security problems scaling from stealing
session cookies to the ability to run arbitrary code on the client
system (depending on the displayed site or security settings).
- CAN-2005-0232: "Fire flashing"
Using plugins like Flash and the -moz-opacity filter it is possible
to display the about:config site in a hidden frame or a new window.
By making the user double-click at a specific screen position
(e.g. using a DHTML game) you can silently toggle the status of
boolean config parameters.
- CAN-2005-0233: "homograph attacks" / "IDN cloaking"
Attackers may spoof host names by using translated host name
representation which look exactly the same as the original host,
allowing phishing attacks or similar.
We now show both IDN punycode and visible form of the host name.
- CAN-2005-0255:
Attackers could cause overflows or crashes in low memory situations.
- Added additional Firefox bugfixes from the 1.0.1 release.
Only the listed distributions are affected, others do not ship
Mozilla Firefox.
Also note that Firefox was called Firebird in SUSE Linux 9.0.
2) solution/workaround
Please install the updated packages. There is no workaround (except
using a different browser).
3) special instructions and notes
Make sure you restart the browser after installing the update.
4) package location and checksums
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
x86 Platform:
SUSE Linux 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/MozillaFirefox-1.0.1-9.1.i586.rpm
03340b9512cc1aef8dc2a100bf66631c
SUSE Linux 9.1:
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/MozillaFirefox-1.0.1-9.1.i586.rpm
93d751acabec7807a9b0bc247c9084a3
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/MozillaFirefox-1.0.1-9.1.src.rpm
2af47975159426d15cc8c3e40b3877b5
SUSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/MozillaFirebird-1.0.1-2.i586.rpm
4731ff8ce252e7535bb94e0d2998b125
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/MozillaFirebird-1.0.1-2.src.rpm
2f60d898cd6f8da2bb98e84d6f1a9a8f
x86-64 Platform:
SUSE Linux 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/MozillaFirefox-1.0.1-9.1.x86_64.rpm
ad04f06e87d2c681672d7264675daabf
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/MozillaFirefox-1.0.1-9.1.src.rpm
44be2cc4c2faae20063b0777b95fd8bd
SUSE Linux 9.1:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/MozillaFirefox-1.0.1-9.1.x86_64.rpm
63c8105d5b6cc13c38039f91da57ed12
source rpm(s):
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/MozillaFirefox-1.0.1-9.1.src.rpm
2a3dffc30e5e000bd9b52fb96cd280ce
SUSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/MozillaFirebird-1.0.1-2.x86_64.rpm
c4bfada21e489e50929b8036f50678c1
source rpm(s):
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/MozillaFirebird-1.0.1-2.src.rpm
ea1efdfe7964b25d34954644e30f9817
______________________________________________________________________________
5) Pending vulnerabilities in SUSE Distributions and Workarounds:
See SUSE Security Summary Report.
______________________________________________________________________________
6) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SUSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
after you downloaded the file from a SUSE ftp server or its mirrors.
Then, compare the resulting md5sum with the one that is listed in the
announcement. Since the announcement containing the checksums is
cryptographically signed (usually using the key security@suse.de),
the checksums show proof of the authenticity of the package.
We disrecommend to subscribe to security lists which cause the
email message containing the announcement to be modified so that
the signature does not match after transport through the mailing
list software.
Downsides: You must be able to verify the authenticity of the
announcement in the first place. If RPM packages are being rebuilt
and a new version of a package is published on the ftp server, all
md5 sums for the files are useless.
2) rpm package signatures provide an easy way to verify the authenticity
of an rpm package. Use the command
rpm -v --checksig
to verify the signature of the package, where is the
filename of the rpm package that you have downloaded. Of course,
package authenticity verification can only target an un-installed rpm
package file.
Prerequisites:
a) gpg is installed
b) The package is signed using a certain key. The public part of this
key must be installed by the gpg program in the directory
~/.gnupg/ under the user's home directory who performs the
signature verification (usually root). You can import the key
that is used by SUSE in rpm packages for SUSE Linux by saving
this announcement to a file ("announcement.txt") and
running the command (do "su -" to be root):
gpg --batch; gpg < announcement.txt | gpg --import
SUSE Linux distributions version 7.1 and thereafter install the
key "build@suse.de" upon installation or upgrade, provided that
the package gpg is installed. The file containing the public key
is placed at the top-level directory of the first CD (pubring.gpg)
and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de .
- SUSE runs two security mailing lists to which any interested party may
subscribe:
suse-security@suse.com
- general/linux/SUSE security discussion.
All SUSE security announcements are sent to this list.
To subscribe, send an email to
.
suse-security-announce@suse.com
- SUSE's announce-only mailing list.
Only SUSE's security announcements are sent to this list.
To subscribe, send an email to
.
For general information or the frequently asked questions (faq)
send mail to:
or
respectively.
=====================================================================
SUSE's security contact is or .
@suse.de>.
The public key is listed below.
=====================================================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way. In particular,
it is desired that the clear-text signature shows proof of the
authenticity of the text.
SUSE Linux AG makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Updated package.