CVE-2009-1307

CVSS V2 Medium 6.8 CVSS V3 None

Description

The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin Policy, which allows remote attackers to (1) bypass crossdomain.xml restrictions and connect to arbitrary web sites via a Flash file; (2) read, create, or modify Local Shared Objects via a Flash file; or (3) bypass unspecified restrictions and render content via vectors involving a jar: URI.

Overview

CVE ID
CVE-2009-1307

Assigner
secalert@redhat.com

Vulnerability Status
Modified

Published Version
2009-04-22T18:30:00

Last Modified Date
2018-10-03T21:59:49

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
cpe:2.3:a:mozilla:firefox::::::::	1	OR	3.0.8
cpe:2.3:a:mozilla:firefox:0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.6.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.7.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9:rc::::::	1	OR
cpe:2.3:a:mozilla:firefox:0.9.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.9_rc:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.10:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:0.10.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0:preview_release::::::	1	OR
cpe:2.3:a:mozilla:firefox:1.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.6::linux:::::	1	OR
cpe:2.3:a:mozilla:firefox:1.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5:beta1::::::	1	OR
cpe:2.3:a:mozilla:firefox:1.5:beta2::::::	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.10:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.11:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.0.12:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.5.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:1.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0:beta_1::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0:beta1::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0:rc2::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0:rc3::::::	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.8:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.9:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.10:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.11:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.12:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.13:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.14:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.15:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.16:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.17:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.18:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.19:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.20:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:2.0.0.21:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0:alpha::::::	1	OR
cpe:2.3:a:mozilla:firefox:3.0:beta2::::::	1	OR
cpe:2.3:a:mozilla:firefox:3.0:beta5::::::	1	OR
cpe:2.3:a:mozilla:firefox:3.0.1:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.2:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.3:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.4:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.5:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.6:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0.7:::::::*	1	OR
cpe:2.3:a:mozilla:firefox:3.0beta5:::::::*	1	OR
cpe:2.3:a:mozilla:seamonkey::::::::	1	OR
cpe:2.3:a:mozilla:thunderbird::::::::	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
NONE

Confidentiality Impact
PARTIAL

Integrity Impact
PARTIAL

Availability Impact
PARTIAL

Base Score
6.8

Severity
MEDIUM

Exploitability Score
8.6

Impact Score
6.4

References

Reference URL	Reference Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=481342	Patch
http://www.mozilla.org/security/announce/2009/mfsa2009-17.html	Vendor Advisory
http://secunia.com/advisories/34894
http://secunia.com/advisories/34758
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html
http://www.securitytracker.com/id?1022093
http://www.redhat.com/support/errata/RHSA-2009-0436.html
http://www.securityfocus.com/bid/34656
http://secunia.com/advisories/34843
http://rhn.redhat.com/errata/RHSA-2009-0437.html
http://secunia.com/advisories/34844
http://www.vupen.com/english/advisories/2009/1125
http://secunia.com/advisories/34780
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:111
http://secunia.com/advisories/35065
http://www.debian.org/security/2009/dsa-1797
http://secunia.com/advisories/35042
http://www.ubuntu.com/usn/usn-782-1
http://www.redhat.com/support/errata/RHSA-2009-1126.html
http://www.redhat.com/support/errata/RHSA-2009-1125.html
http://secunia.com/advisories/35536
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408
http://secunia.com/advisories/35561
http://www.mandriva.com/security/advisories?name=MDVSA-2009:141
http://secunia.com/advisories/35602
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html
http://secunia.com/advisories/35882
http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1
http://www.debian.org/security/2009/dsa-1830
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7008
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6266
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6154
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5933
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10972
https://usn.ubuntu.com/764-1/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2009-1307
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1307

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 18:36:19				Added to TrackCVE