Ravens PHP Scripts

Mozilla Firefox Wizz RSS News Reader Extension Cross-Context Scripting
Date: Wednesday, April 18, 2007 @ 01:33:43 CEST
Topic: Security


SECUNIA ADVISORY ID: SA24913

VERIFY ADVISORY: http://secunia.com/advisories/24913/

CRITICAL: Highly critical

IMPACT: Cross Site Scripting, System access

WHERE: >From remote

SOFTWARE: Wizz RSS News Reader (Extension for Mozilla Firefox) 2.x - http://secunia.com/product/13955/

DESCRIPTION: A vulnerability has been reported in the Wizz RSS News Reader extension for Mozilla Firefox, which can be exploited by malicious people to compromise a vulnerable system.



Certain input is not properly sanitised before being used and can be exploited to e.g. execute arbitrary script code within the "chrome:" context. Successful exploitation requires that a user is tricked into loading a specially crafted RSS feed. The vulnerability is reported in versions prior to 2.1.9.

SOLUTION: Update to version 2.1.9. - https://addons.mozilla.org/en-US/firefox/addon/424

PROVIDED AND/OR DISCOVERED BY: The vendor credits Jefferson Ogata, NOAA Computer Incident Response Team.

ORIGINAL ADVISORY: Wizz RSS News Reader: - https://addons.mozilla.org/en-US/firefox/addon/424

OTHER REFERENCES: US-CERT VU#319464: http://www.kb.cert.org/vuls/id/319464






This article comes from Ravens PHP Scripts
http://www.ravenphpscripts.com

The URL for this story is:
http://www.ravenphpscripts.com/modules.php?name=News&file=article&sid=2863