{"vuid":"VU#113192","idnumber":"113192","name":"Mozilla allows signed scripts calling \"enablePrivilege\" to change contents of a \"grant\" dialog","keywords":["Mozilla","arbitrary code execution","scripts","enablePrivilege","grant dialog"],"overview":"A vulnerability in the way Mozilla and its derived programs display dialogs in some circumstances could allow a remote attacker to install and run software on a vulnerable system.","clean_desc":"The Mozilla web browser and related Mozilla products support the ability to run signed scripts supplied in HTML email or webpages. A signed script can request expanded privileges that give it access to restricted information and abilities by using the enablePrivilege method. A deficiency in the way that these products create dialog boxes via enablePrivilege allows a malicious script to supply a string including spaces and normal text for the dialog box. A malicious signed script requesting enhanced abilities could construct the request in a way that possibly fooled the user into thinking the privilege requested was inconsequential while actually obtaining explicit permission to run and install software. The user would still be required to explicitly click \"Ok\" in the grant dialog for exploitation of this issue to be successful.","impact":"By convincing a victim to accept a signed script, a remote attacker may be able to install and run software with the privileges of the user running an affected program.","resolution":"Upgrade to a fixed version of the affected software The Mozilla Project has released new versions of the affected software that include patches for this vulnerability. Please see the Systems Affected section of this document for more information.","workarounds":"Workarounds Users who are unable to upgrade to a patched version of the software are encouraged to apply the following workarounds: Disable Javascript\nNever grant enhanced abilities of any kind to untrusted web pages (this workaround comes from from the Mozilla project advisory about this issue)","sysaffected":"","thanks":"Information about this issue was originally published by the \nMozilla Project\n. The Mozilla Project, in turn, credits Jesse Ruderman with the discovery and reporting of this issue","author":"This document was written by Chad R Dougherty.","public":["http://bugzilla.mozilla.org/show_bug.cgi?id=253942","http://secunia.com/advisories/12526/","http://www.securitytracker.com/alerts/2004/Sep/1011317.html","http://www.securitytracker.com/alerts/2004/Sep/1011318.html"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2004-09-16T13:32:48Z","publicdate":"2004-09-14T00:00:00Z","datefirstpublished":"2004-09-17T18:08:27Z","dateupdated":"2004-10-26T15:26:45Z","revision":9,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"8","cam_population":"15","cam_impact":"4","cam_easeofexploitation":"12","cam_attackeraccessrequired":"20","cam_scorecurrent":"6.21","cam_scorecurrentwidelyknown":"7.56","cam_scorecurrentwidelyknownexploited":"12.96","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":6.21,"vulnote":null}