HTTP Mozilla InstallVersion CompareTo BO

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

This signature detects attempts to exploit a buffer overflow vulnerability in the Mozilla Suite and FireFox.

Additional Information

The Mozilla Foundation has released 12 security advisories specifying security vulnerabilities in Mozilla Suite, Firefox, and Thunderbird. The specific vulnerabilities are as follows.

MFSA 2005-50: Mozilla Suite and Firefox are susceptible to a vulnerability in 'InstallVersion.compareTo'. This issue results in an access violation crash; remote code execution may also be possible.

Affected

Conectiva Linux 6.0, 7.0, 8.0
Debian Linux 3.1, 3.1 alpha, 3.1 amd64, 3.1 arm, 3.1 hppa, 3.1 ia-32, 3.1 ia-64, 3.1 m68k, 3.1 mips, 3.1 mipsel, 3.1 ppc, 3.1 s/390, 3.1 sparc
Easy Software Products CUPS 1.1.20
Galeon Galeon Browser 1.3.17
Gentoo Linux
GNOME devhelp 0.9.2, 0.10
GNOME Epiphany 1.2.5, 1.2.9, 1.4.4, 1.6.3
GNOME yelp 2.10
HP HP-UX B.11.00, B.11.11, B.11.22, B.11.23
HP Secure Web Browser for OpenVMS Alpha 1.7-7, 1.7-8
HP Secure Web Browser for OpenVMS I64 1.7-7, 1.7-8
K-Meleon K-Meleon 0.9
libpng libpng 1.0.15
libpng libpng3 1.2.5
MandrakeSoft Corporate Server 3.0, 3.0 x86_64
MandrakeSoft Linux Mandrake 8.2, 8.2 ppc, 10.1, 10.1 x86_64, 10.2, 10.2 x86_64
Mozilla Browser M15, M16, 0.8, 0.9.2, 0.9.2.1, 0.9.3, 0.9.4, 0.9.4.1, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 0.9.9, 0.9.35, 0.9.48, 1.0, 1.0 RC1, 1.0 RC2, 1.0.1, 1.0.2, 1.1, 1.1 Alpha, 1.1 Beta, 1.2, 1.2 Alpha, 1.2 Beta, 1.2.1, 1.3, 1.3.1, 1.4, 1.4 a, 1.4 b, 1.4.1, 1.4.2, 1.4.4, 1.5, 1.5.1, 1.6, 1.7, 1.7 alpha, 1.7 beta, 1.7 rc1, 1.7 rc2, 1.7 rc3, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8 Alpha 1, 1.8 Alpha 2, 1.8 Alpha 3, 1.8 Alpha 4
Mozilla Firefox Preview Release, 0.8, 0.9, 0.9 rc, 0.9.1, 0.9.2, 0.9.3, 0.10, 0.10.1, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4
Mozilla Thunderbird 0.6, 0.7, 0.7.1, 0.7.2, 0.7.3, 0.8, 0.9, 1.0, 1.0.1, 1.0.2, 1.0.5
Netscape Netscape 7.2, 8.0, 8.0.1, 8.0.2
RedHat Advanced Workstation for the Itanium Processor 2.1, 2.1 IA64
RedHat Desktop 3.0, 4.0
RedHat Enterprise Linux AS 2.1, AS 2.1 IA64, AS 3, AS 4, ES 2.1, ES 2.1 IA64, ES 3, ES 4, WS 2.1, WS 2.1 IA64, WS 3, WS 4
RedHat Fedora Core1, Core2, Core3, Core4
RedHat Linux 8.0, 8.0 i386, 9.0 i386
S.u.S.E. Linux 8.2, 9.0, 9.0 x86_64, 9.1, 9.1 x86_64
S.u.S.E. Linux Desktop 1.0
S.u.S.E. Linux Enterprise Server 8, 9
S.u.S.E. Linux Personal 9.2, 9.2 x86_64, 9.3, 9.3 x86_64, 10.0 OSS
S.u.S.E. Linux Professional 8.2, 9.0, 9.0 x86_64, 9.1, 9.1 x86_64, 9.2, 9.2 x86_64, 9.3, 9.3 x86_64, 10.0, 10.0 OSS
S.u.S.E. Novell Linux Desktop 9.0
SGI ProPack 3.0 SP6
Slackware Linux -current, 9.0, 10.0, 10.1
Sun Solaris 8.0, 8.0_x86, 9.0, 9.0_x86, 9.0_x86 Update 2, 10.0, 10.0_x86
Ubuntu Ubuntu Linux 4.1 ia32, 4.1 ia64, 4.1 ppc, 5.0 4 amd64, 5.0 4 i386, 5.0 4 powerpc
Xpdf Xpdf 3.0

Response

Possible False Positives

There are no known cases of false positives associated with this signature.