Mozilla Firefox Firebug Extension *console.log()* Cross-Context Scripting

Posted on Friday, April 06, 2007 @ 10:54:44 PDT in Security
by Raven

SECUNIA ADVISORY ID: SA24743

VERIFY ADVISORY: http://secunia.com/advisories/24743/

CRITICAL: Highly critical

IMPACT: Cross Site Scripting, System access

WHERE: >From remote

SOFTWARE: Firebug (Extension for Mozilla Firefox) 1.x - http://secunia.com/product/13856/

DESCRIPTION: pdp has reported a vulnerability in the Firebug extension for Mozilla Firefox, which can be exploited by malicious people to compromise a vulnerable system.

Firebug does not properly sanitise input passed to the "console.log()" function. This can be exploited to e.g. execute arbitrary script code within the "chrome:" context by tricking a user into visiting a malicious website. The vulnerability is reported in versions prior to 1.02.

SOLUTION: Update to version 1.02.

PROVIDED AND/OR DISCOVERED BY: pdp

ORIGINAL ADVISORY:
https://addons.mozilla.org/en-US/firefox/addons/versions/1843
http://www.gnucitizen.org/blog/firebug-goes-evil
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 346,392,765
  • Today: 47,769
Server InfoServer Info
  • Jan 22, 2018
  • 10:22 pm PST
 
 

Daily Inspiration