Bug 496267 (CVE-2009-1309) - CVE-2009-1309 Firefox Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
Summary: CVE-2009-1309 Firefox Same-origin violations in XMLHttpRequest and XPCNativeW...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-1309
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://web.nvd.nist.gov/view/vuln/det...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-04-17 15:19 UTC by Josh Bressers
Modified: 2019-09-29 12:30 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2009-09-18 17:25:53 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:0436 0 normal SHIPPED_LIVE Critical: firefox security update 2009-04-22 01:42:27 UTC
Red Hat Product Errata RHSA-2009:0437 0 normal SHIPPED_LIVE Critical: seamonkey security update 2009-04-21 23:59:24 UTC
Red Hat Product Errata RHSA-2009:1125 0 normal SHIPPED_LIVE Moderate: thunderbird security update 2009-06-25 15:18:31 UTC
Red Hat Product Errata RHSA-2009:1126 0 normal SHIPPED_LIVE Moderate: thunderbird security update 2009-06-25 15:07:24 UTC

Description Josh Bressers 2009-04-17 15:19:25 UTC
Mozilla security researcher moz_bug_r_a4 reported that it is possible to
create a document whose URI does not match the document's principal using
XMLHttpRequest. This type of mismatch leads to incorrect results in
principal-based security checks. An attacker could use this vulnerability
to execute arbitrary JavaScript within the context of another site.

moz_bug_r_a4 separately reported that XPCNativeWrapper.toString's __proto__
comes from the wrong scope which results in calls to that function being
executed in the wrong context in certain circumstances. An attacker could
use this vulnerability to run arbitrary code within the context of a
different site. Alternatively, if chrome were to call
content.toString.call(), then attacker-defined functions could be run with
chrome privileges.

Comment 2 errata-xmlrpc 2009-04-21 23:59:55 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 2.1

Via RHSA-2009:0437 https://rhn.redhat.com/errata/RHSA-2009-0437.html

Comment 3 errata-xmlrpc 2009-04-22 01:43:16 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:0436 https://rhn.redhat.com/errata/RHSA-2009-0436.html

Comment 4 Fedora Update System 2009-04-22 20:25:19 UTC
xulrunner-1.9.0.9-1.fc9, firefox-3.0.9-1.fc9, epiphany-extensions-2.22.1-10.fc9, epiphany-2.22.2-10.fc9, blam-1.8.5-8.fc9.1, chmsee-1.0.1-11.fc9, devhelp-0.19.1-11.fc9, evolution-rss-0.1.0-10.fc9, galeon-2.0.7-9.fc9, gnome-python2-extras-2.19.1-26.fc9, gnome-web-photo-0.3-20.fc9, google-gadgets-0.10.5-5.fc9, gtkmozembedmm-1.4.2.cvs20060817-28.fc9, kazehakase-0.5.6-4.fc9.1, Miro-2.0.3-3.fc9, mozvoikko-0.9.5-9.fc9, mugshot-1.2.2-8.fc9, ruby-gnome2-0.17.0-8.fc9, totem-2.23.2-14.fc9, yelp-2.22.1-11.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2009-04-24 19:50:41 UTC
xulrunner-1.9.0.9-1.fc10, firefox-3.0.9-1.fc10, epiphany-extensions-2.24.0-7.fc10, epiphany-2.24.3-5.fc10, blam-1.8.5-9.fc10, devhelp-0.22-7.fc10, galeon-2.0.7-9.fc10, gecko-sharp2-0.13-7.fc10, gnome-python2-extras-2.19.1-29.fc10, gnome-web-photo-0.3-17.fc10, google-gadgets-0.10.5-5.fc10, kazehakase-0.5.6-4.fc10.1, Miro-2.0.3-3.fc10, mozvoikko-0.9.5-9.fc10, mugshot-1.2.2-8.fc10, pcmanx-gtk2-0.3.8-8.fc10, perl-Gtk2-MozEmbed-0.08-5.fc10.2, ruby-gnome2-0.18.1-5.fc10.1, yelp-2.24.0-8.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 errata-xmlrpc 2009-06-25 15:07:43 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1126 https://rhn.redhat.com/errata/RHSA-2009-1126.html

Comment 7 errata-xmlrpc 2009-06-25 15:18:55 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1125 https://rhn.redhat.com/errata/RHSA-2009-1125.html

Comment 8 errata-xmlrpc 2009-06-25 15:26:57 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1125 https://rhn.redhat.com/errata/RHSA-2009-1125.html


Note You need to log in before you can comment on or make changes to this bug.