Ravens PHP Scripts

Mozilla Firefox Firebug Extension *console.log()* Cross-Context Scripting
Date: Friday, April 06, 2007 @ 09:54:44 PDT
Topic: Security


SECUNIA ADVISORY ID: SA24743

VERIFY ADVISORY: http://secunia.com/advisories/24743/

CRITICAL: Highly critical

IMPACT: Cross Site Scripting, System access

WHERE: >From remote

SOFTWARE: Firebug (Extension for Mozilla Firefox) 1.x - http://secunia.com/product/13856/

DESCRIPTION: pdp has reported a vulnerability in the Firebug extension for Mozilla Firefox, which can be exploited by malicious people to compromise a vulnerable system.



Firebug does not properly sanitise input passed to the "console.log()" function. This can be exploited to e.g. execute arbitrary script code within the "chrome:" context by tricking a user into visiting a malicious website. The vulnerability is reported in versions prior to 1.02.

SOLUTION: Update to version 1.02.

PROVIDED AND/OR DISCOVERED BY: pdp

ORIGINAL ADVISORY:
https://addons.mozilla.org/en-US/firefox/addons/versions/1843
http://www.gnucitizen.org/blog/firebug-goes-evil






This article comes from Ravens PHP Scripts
http://www.ravenphpscripts.com

The URL for this story is:
http://www.ravenphpscripts.com/modules.php?name=News&file=article&sid=2847