1. CVE-Search
  2. CVE-2005-2270
ID CVE-2005-2270
Summary Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-10-2017 - 01:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
  • accepted 2007-05-09T16:10:26.656-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Matthew Wojcik
      organization The MITRE Corporation
    • name John Hoyland
      organization Centennial Software
    • name John Hoyland
      organization Centennial Software
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    description Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
    family windows
    id oval:org.mitre.oval:def:100003
    status accepted
    submitted 2005-08-16T04:00:00.000-04:00
    title Firefox and Mozilla Shared Object Code Execution
    version 7
  • accepted 2013-04-29T04:15:36.855-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
    family unix
    id oval:org.mitre.oval:def:11751
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
    version 29
  • accepted 2013-04-08T04:00:47.014-04:00
    class vulnerability
    contributors
    • name Jay Beale
      organization Bastille Linux
    • name Dragos Prisaca
      organization Symantec Corporation
    • name Dragos Prisaca
      organization G2, Inc.
    description Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
    family unix
    id oval:org.mitre.oval:def:550
    status accepted
    submitted 2005-08-15T04:00:00.000-04:00
    title RHE4 Firefox and Mozilla Shared Object Code Execution
    version 8
  • accepted 2005-10-12T05:49:00.000-04:00
    class vulnerability
    contributors
    name Jay Beale
    organization Bastille Linux
    description Firefox before 1.0.5 and Mozilla before 1.7.9 does not properly clone base objects, which allows remote attackers to execute arbitrary code by navigating the prototype chain to reach a privileged object.
    family unix
    id oval:org.mitre.oval:def:817
    status accepted
    submitted 2005-08-15T04:00:00.000-04:00
    title RHE3 Firefox and Mozilla Shared Object Code Execution
    version 4
redhat via4
advisories
  • rhsa
    id RHSA-2005:586
  • rhsa
    id RHSA-2005:587
  • rhsa
    id RHSA-2005:601
rpms
  • firefox-0:1.0.6-1.4.1
  • firefox-debuginfo-0:1.0.6-1.4.1
  • devhelp-0:0.9.2-2.4.6
  • devhelp-debuginfo-0:0.9.2-2.4.6
  • devhelp-devel-0:0.9.2-2.4.6
  • thunderbird-0:1.0.6-1.4.1
  • thunderbird-debuginfo-0:1.0.6-1.4.1
refmap via4
bid 14242
cert-vn VU#652366
ciac P-252
confirm http://www.mozilla.org/security/announce/mfsa2005-56.html
debian DSA-810
fedora FLSA:160202
misc
sectrack 1014470
secunia
  • 16043
  • 16059
  • 19823
suse
  • SUSE-SA:2005:045
  • SUSE-SA:2006:022
  • SUSE-SR:2005:018
vupen ADV-2005-1075
Last major update 11-10-2017 - 01:30
Published 13-07-2005 - 04:00
Last modified 11-10-2017 - 01:30
Back to Top