Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.51128
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2004:110
Summary:NOSUMMARY
Description:Description:

The remote host is missing updates announced in
advisory RHSA-2004:110.

Mozilla is a Web browser and mail reader, designed for standards
compliance, performance and portability. Network Security Services (NSS)
is a set of libraries designed to support cross-platform development of
security-enabled server applications.

NISCC testing of implementations of the S/MIME protocol uncovered a number
of bugs in NSS versions prior to 3.9. The parsing of unexpected ASN.1
constructs within S/MIME data could cause Mozilla to crash or consume large
amounts of memory. A remote attacker could potentially trigger these bugs
by sending a carefully-crafted S/MIME message to a victim. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CVE-2003-0564 to this issue.

Andreas Sandblad discovered a cross-site scripting issue that affects
various versions of Mozilla. When linking to a new page it is still
possible to interact with the old page before the new page has been
successfully loaded. Any Javascript events will be invoked in the context
of the new page, making cross-site scripting possible if the different
pages belong to different domains. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0191 to
this issue.

Flaws have been found in the cookie path handling between a number of Web
browsers and servers. The HTTP cookie standard allows a Web server
supplying a cookie to a client to specify a subset of URLs on the origin
server to which the cookie applies. Web servers such as Apache do not
filter returned cookies and assume that the client will only send back
cookies for requests that fall within the server-supplied subset of URLs.
However, by supplying URLs that use path traversal (/../) and character
encoding, it is possible to fool many browsers into sending a cookie to a
path outside of the originally-specified subset. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CVE-2003-0594 to this issue.

Users of Mozilla are advised to upgrade to these updated packages, which
contain Mozilla version 1.4.2 and are not vulnerable to these issues.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2004-110.html
http://www.mozilla.org/projects/security/pki/nss/#NSS_39
http://bugzilla.mozilla.org/show_bug.cgi?id=227417
http://www.niscc.gov.uk/

Risk factor : High

CVSS Score:
7.5

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2003-0564
BugTraq ID: 8981
http://www.securityfocus.com/bid/8981
CERT/CC vulnerability note: VU#428230
http://www.kb.cert.org/vuls/id/428230
http://marc.info/?l=bugtraq&m=109900315219363&w=2
HPdes Security Advisory: SSRT4722
http://marc.info/?l=bugtraq&m=108448379429944&w=2
http://www.mandriva.com/security/advisories?name=MDKSA-2004:021
http://www.uniras.gov.uk/vuls/2003/006489/smime.htm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11462
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A872
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A914
http://www.redhat.com/support/errata/RHSA-2004-110.html
http://www.redhat.com/support/errata/RHSA-2004-112.html
SGI Security Advisory: 20040402-01-U
ftp://patches.sgi.com/support/free/security/advisories/20040402-01-U.asc
XForce ISS Database: smime-asn1-bo(13603)
https://exchange.xforce.ibmcloud.com/vulnerabilities/13603
Common Vulnerability Exposure (CVE) ID: CVE-2003-0594
http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A873
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A917
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9826
http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html
Common Vulnerability Exposure (CVE) ID: CVE-2004-0191
BugTraq ID: 9747
http://www.securityfocus.com/bid/9747
Bugtraq: 20040225 Sandblad #13: Cross-domain exploit on zombie document with event handlers (Google Search)
http://marc.info/?l=bugtraq&m=107774710729469&w=2
http://www.osvdb.org/4062
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A874
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A937
XForce ISS Database: mozilla-event-handler-xss(15322)
https://exchange.xforce.ibmcloud.com/vulnerabilities/15322
CopyrightCopyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.