CVE-2007-3089

CVE Details

Release Date:	2007-06-06
Impact:	Moderate	What is this?

Description

Mozilla Firefox before 2.0.0.5 does not prevent use of document.write to replace an IFRAME (1) during the load stage or (2) in the case of an about:blank frame, which allows remote attackers to display arbitrary HTML or execute certain JavaScript code, as demonstrated by code that intercepts keystroke values from window.event, aka the promiscuous IFRAME access bug, a related issue to CVE-2006-4568. Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scripting (XSS) attacks with chrome privileges via an addon that inserts a (1) javascript: or (2) data: link into an about:blank document loaded by chrome via (a) the window.open function or (b) a content.location assignment, aka Cross Context Scripting. NOTE: this issue is caused by a CVE-2007-3089 regression.

See more information about CVE-2007-3089 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	4.3
Vector String:	AV:N/AC:M/Au:N/C:N/I:P/A:N
Version:	2.0
Attack Vector:	Network
Attack Complexity:	Medium
Authentication:	None
Confidentiality Impact:	None
Integrity Impact:	Partial
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 3 (seamonkey)	ELSA-2007-0722	2007-07-19
Oracle Enterprise Linux version 4 (firefox)	ELSA-2007-0724	2007-07-19
Oracle Enterprise Linux version 4 (seamonkey)	ELSA-2007-0722	2007-07-19
Oracle Enterprise Linux version 4 (thunderbird)	ELSA-2007-0723	2007-07-19
Oracle Linux version 5 (firefox)	ELSA-2007-0724	2007-07-19