Users of ZDI please be advised of a Mozilla Firefox NodeIterator Remote Code Execution Vulnerability that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)
Amplify’d from www.criticalwatch.com
ZDI-10-130: ZDI-10-130: Mozilla Firefox NodeIterator Remote Code Execution Vulnerability
Mozilla Firefox NodeIterator Remote Code
-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Mozilla Firefox. User interaction is
required to exploit this vulnerability in that the victim must visit a
malicious page or open a malicious file.
The specific flaw exists within the application's implementation of the
NodeIterator interface for traversal of the Document Object Model. Due
to the implementation requiring a javascript callback, an attacker can
utilize the callback in order to manipulate the contents of the page. By
doing so in an unexpected manner, an attacker can cause the process to
corrupt memory. Successful exploitation will lead to code execution
under the context of the application.
Read more at www.criticalwatch.com
See this Amp at http://bit.ly/9yX3xk
No comments:
Post a Comment