NetSight
IP …
medium4.3Public exploit code

CVE-2008-4582

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the contex…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly identify the context of Windows .url shortcut files, which allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via an HTML document that is directly accessible through a filesystem, as demonstrated by documents in (1) local folders, (2) Windows share folders, and (3) RAR archives, and as demonstrated by IFRAMEs referencing shortcuts that point to (a) about:cache?device=memory and (b) about:cache?device=disk, a variant of CVE-2008-2810.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 4.0
MozillaFirefox
Versions 3.0.1, 3.0.2, 3.0.3, 2.0, 2.0.0.1, 2.0.0.10
CanonicalUbuntu Linux
Versions 6.06, 7.10, 8.04, 8.10
MozillaSeamonkey
Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5

Weakness classification

CWE-264

References