CVE-2009-0356: Medium severity Mozilla SeaMonkey vulnerability
Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to representation of about: URIs as jar:file:// URIs. NOTE: this issue exists because of an incomplete fix for CVE-2008-4582.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 3.0.6 - Compensating control
Prevent or block opening .desktop files that contain a Desktop Entry URL field referencing about:plugins or about:config. Implement OS-level restrictions or policies to disallow executing or loading .desktop files from untrusted sources, and restrict users from opening such .desktop files in Firefox or SeaMonkey until a vendor fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0356?
CVE-2009-0356 is considered a high severity vulnerability due to its potential for code execution with elevated privileges.
How do I fix CVE-2009-0356?
To mitigate CVE-2009-0356, users should upgrade to Mozilla Firefox version 3.0.6 or later, or to the latest version of SeaMonkey.
What does CVE-2009-0356 exploit?
CVE-2009-0356 exploits the ability to bypass the Same Origin Policy via links in .desktop files, allowing attackers to execute arbitrary code.
Which versions are affected by CVE-2009-0356?
CVE-2009-0356 affects Mozilla Firefox versions prior to 3.0.6 and multiple versions of SeaMonkey.
Is there a workaround for CVE-2009-0356?
A reliable workaround for CVE-2009-0356 is not available, and users are strongly advised to upgrade their browser versions.