CVE-2009-1839: Medium severity Mozilla Firefox vulnerability
Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack.
Other sources
Security researchers Adam Barth and Collin Jackson reported that when a file: resource is loaded via the location bar it inherits the principal of the previously loaded document. This vulnerability can potentially give the newly loaded document additional privileges to access resources that it wouldn't otherwise have, including resources in the document's parent folder.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1839?
CVE-2009-1839 is categorized as a moderate severity vulnerability that allows unauthorized access to local files.
How do I fix CVE-2009-1839?
To remediate CVE-2009-1839, upgrade Mozilla Firefox to version 3.0.11 or later.
What versions of Mozilla Firefox are affected by CVE-2009-1839?
CVE-2009-1839 affects multiple versions of Mozilla Firefox prior to 3.0.11, specifically versions 3.0.0 to 3.0.10 and 3.1 beta.
What type of attack is associated with CVE-2009-1839?
CVE-2009-1839 is associated with a 'file-URL-to-file-URL scripting' attack, which can be exploited by user-assisted remote attackers.
Can CVE-2009-1839 allow access to sensitive information?
Yes, CVE-2009-1839 can enable attackers to bypass intended access restrictions and read sensitive local files.