FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Mozilla / Firefox user interface spoofing vulnerability

Affected packages
firefox <= 0.9.1_1
linux-mozilla <= 1.7.1
linux-mozilla-devel <= 1.7.1
mozilla <= 1.7.1,2
1.8.a,2 <= mozilla <= 1.8.a2,2
mozilla-gtk1 <= 1.7.1_1

Details

VuXML ID 730db824-e216-11d8-9b0a-000347a4fa7d
Discovery 2004-07-19
Entry 2004-07-30
Modified 2004-08-15

The Mozilla project's family of browsers contain a design flaw that can allow a website to spoof almost perfectly any part of the Mozilla user interface, including spoofing web sites for phishing or internal elements such as the "Master Password" dialog box. This achieved by manipulating "chrome" through remote XUL content. Recent versions of Mozilla have been fixed to not allow untrusted documents to utilize "chrome" in this way.

References

Bugtraq ID 10832
CVE Name CVE-2004-0764
URL http://bugzilla.mozilla.org/show_bug.cgi?id=22183
URL http://bugzilla.mozilla.org/show_bug.cgi?id=244965
URL http://bugzilla.mozilla.org/show_bug.cgi?id=252198
URL http://secunia.com/advisories/12188
URL http://www.nd.edu/~jsmith30/xul/test/spoof.html