Bug 2169667 (CVE-2007-3845)

Summary: CVE-2007-3845 Mozilla: Unescaped URIs passed to external programs
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: erack, jhorak, nobody, stransky, tpopela
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: firefox 2.0.0.6, thunderbird 1.5.0.13, thunderbird 2.0.0.6 Doc Type: ---
Doc Text:
The Mozilla Foundation Security Advisory describes this flaw as: Jesper Johansson pointed out that Mozilla did not percent-encode spaces and double-quotes in URIs handed off to external programs for handling, which can cause the receiving program to mistakenly interpret a single URI as multiple arguments. The danger depends on the arguments supported by the specific receiving program, though at the very least we know Firefox (and Thunderbird) 2.0.0.4 and older could be used to run arbitrary script (see MFSA 2007-23). The vast majority of programs do not have dangerous arguments, though many could still be made to do something unexpected.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-02-16 00:41:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mauro Matteo Cascella 2023-02-14 09:18:55 UTC 
Jesper Johansson pointed out that Mozilla did not percent-encode spaces and double-quotes in URIs handed off to external programs for handling, which can cause the receiving program to mistakenly interpret a single URI as multiple arguments. The danger depends on the arguments supported by the specific receiving program, though at the very least we know Firefox (and Thunderbird) 2.0.0.4 and older could be used to run arbitrary script (see MFSA 2007-23). The vast majority of programs do not have dangerous arguments, though many could still be made to do something unexpected.

References:
https://www.mozilla.org/en-US/security/advisories/mfsa2007-27/
https://nvd.nist.gov/vuln/detail/CVE-2007-3845
https://bugzilla.mozilla.org/show_bug.cgi?id=389106
https://bugzilla.mozilla.org/show_bug.cgi?id=389580
Comment 1 Product Security DevOps Team 2023-02-16 00:41:32 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2007-3845