Related information

Mozilla Firefox / Thunderbird / SeaMonkey multiple security vulnerabilities

ZDI-10-176: Mozilla Firefox normalizeDocument Remote Code Execution Vulnerability

ZDI-10-171: Mozilla Firefox nsTreeContentView Dangling Pointer Remote Code Execution Vulnerability

ZDI-10-172: Mozilla Firefox tree Object Removal Remote Code Execution Vulnerability

ZDI-10-173: Mozilla Firefox nsTreeSelection Dangling Pointer Remote Code Execution Vulnerability

From:	Amit Klein <amit.klein_(at)_trusteer.com>
Date:	16.09.2010
Subject:	New writeup by Amit Klein (Trusteer): "Cross-domain information leakage in Firefox 3.6.4-3.6.8, Firefox 3.5.10-3.5.11 and Firefox 4.0 Beta1"

Hi list

I would like to announce a new writeup, titled "Cross-domain
information leakage in Firefox 3.6.4-3.6.8, Firefox 3.5.10-3.5.11
and Firefox 4.0 Beta1".

The writeup is available in the following URL:

http://www.trusteer.com/sites/default/files/Cross_domain_Math_Random_leakage_in_F
F_3.6.4-3.6.8.pdf

Abstract:
While Mozilla attempted to address the issues of cross domain
information leakage (through Math.random) in Firefox 3.6.4, Firefox
3.5.10 and Firefox 4.0 Beta-1, there is still a security
vulnerability in the way the isolation is implemented, which enables
cross domain leakage. In fact, it may make it easier to attack
Firefox in some cases, compared to previous versions.
Additionally, a concerned is raised on the entropy provided in the
seed to the Math.random PRNG, which may enable more powerful attacks.

This isolation issue was fixed in Firefox 3.6.9, 3.5.12 and 4.0 Beta2.

This issue has been assigned a CVE code CVE-2010-3171.

Thanks,
-Amit

Amit Klein, CTO, Trusteer