National Cyber Awareness System

Vulnerability Summary for CVE-2007-3511

Overview

The focus handling for the onkeydown event in Mozilla Firefox 1.5.0.12, 2.0.0.4 and other versions before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to change field focus and copy keystrokes via the "for" attribute in a label, which bypasses the focus prevention, as demonstrated by changing focus from a textarea to a file upload field.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2007-2664

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html

External Source: FEDORA

Name: FEDORA-2007-2601

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html

External Source: FEDORA

Name: FEDORA-2007-3431

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1858

Hyperlink:https://issues.rpath.com/browse/RPL-1858

External Source: MISC

Name: http://yathong.googlepages.com/FirefoxFocusBug.html

Hyperlink:http://yathong.googlepages.com/FirefoxFocusBug.html

External Source: XF

Name: firefox-focus-security-bypass(35299)

Hyperlink:http://xforce.iss.net/xforce/xfdb/35299

External Source: VUPEN

Name: ADV-2008-0083

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/0083

External Source: VUPEN

Name: ADV-2007-3587

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2007/3587

External Source: VUPEN

Name: ADV-2007-3544

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2007/3544

External Source: UBUNTU

Name: USN-535-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-535-1

External Source: UBUNTU

Name: USN-536-1

Hyperlink:http://www.ubuntu.com/usn/usn-536-1

External Source: BID

Name: 24725

Hyperlink:http://www.securityfocus.com/bid/24725

External Source: BUGTRAQ

Name: 20071029 rPSA-2007-0225-2 firefox thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482932/100/200/threaded

External Source: BUGTRAQ

Name: 20071029 FLEA-2007-0062-1 firefox

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482925/100/0/threaded

External Source: BUGTRAQ

Name: 20071026 rPSA-2007-0225-1 firefox

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/482876/100/200/threaded

External Source: REDHAT

Name: RHSA-2007:0981

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0981.html

External Source: REDHAT

Name: RHSA-2007:0980

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0980.html

External Source: REDHAT

Name: RHSA-2007:0979

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0979.html

External Source: SUSE

Name: SUSE-SA:2007:057

Hyperlink:http://www.novell.com/linux/security/advisories/2007_57_mozilla.html

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2007/mfsa2007-32.html

Hyperlink:http://www.mozilla.org/security/announce/2007/mfsa2007-32.html

External Source: MANDRIVA

Name: MDKSA-2007:202

Hyperlink:http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202

External Source: DEBIAN

Name: DSA-1401

Hyperlink:http://www.debian.org/security/2007/dsa-1401

External Source: DEBIAN

Name: DSA-1396

Hyperlink:http://www.debian.org/security/2007/dsa-1396

External Source: DEBIAN

Name: DSA-1392

Hyperlink:http://www.debian.org/security/2007/dsa-1392

External Source: CONFIRM

Name: http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html

Hyperlink:http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html

External Source: SUNALERT

Name: 201516

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

External Source: MISC

Name: http://sla.ckers.org/forum/read.php?3,13142

Hyperlink:http://sla.ckers.org/forum/read.php?3,13142

External Source: SECTRACK

Name: 1018837

Hyperlink:http://securitytracker.com/id?1018837

External Source: SECUNIA

Name: 27680

Type: Advisory

Hyperlink:http://secunia.com/advisories/27680

External Source: SECUNIA

Name: 27480

Type: Advisory

Hyperlink:http://secunia.com/advisories/27480

External Source: SECUNIA

Name: 27425

Type: Advisory

Hyperlink:http://secunia.com/advisories/27425

External Source: SECUNIA

Name: 27414

Type: Advisory

Hyperlink:http://secunia.com/advisories/27414

External Source: SECUNIA

Name: 27403

Type: Advisory

Hyperlink:http://secunia.com/advisories/27403

External Source: SECUNIA

Name: 27387

Type: Advisory

Hyperlink:http://secunia.com/advisories/27387

External Source: SECUNIA

Name: 27383

Type: Advisory

Hyperlink:http://secunia.com/advisories/27383

External Source: SECUNIA

Name: 27356

Type: Advisory

Hyperlink:http://secunia.com/advisories/27356

External Source: SECUNIA

Name: 27336

Type: Advisory

Hyperlink:http://secunia.com/advisories/27336

External Source: SECUNIA

Name: 27335

Type: Advisory

Hyperlink:http://secunia.com/advisories/27335

External Source: SECUNIA

Name: 27327

Type: Advisory

Hyperlink:http://secunia.com/advisories/27327

External Source: SECUNIA

Name: 27325

Type: Advisory

Hyperlink:http://secunia.com/advisories/27325

External Source: SECUNIA

Name: 27298

Type: Advisory

Hyperlink:http://secunia.com/advisories/27298

External Source: SECUNIA

Name: 27276

Type: Advisory

Hyperlink:http://secunia.com/advisories/27276

External Source: SECUNIA

Name: 25904

Type: Advisory

Hyperlink:http://secunia.com/advisories/25904

External Source: OVAL

Name: oval:org.mitre.oval:def:9763

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9763

External Source: OSVDB

Name: 37994

Hyperlink:http://osvdb.org/37994

External Source: HP

Name: HPSBUX02153

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: HP

Name: HPSBUX02153

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: FULLDISC

Name: 20070630 Re: New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0658.html

External Source: FULLDISC

Name: 20070630 New flaw found in Firefox 2.0.0.4: Firefox file input focus vulnerabilities

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0646.html

References to Check Content

Identifier:oval:org.mitre.oval:def:9763

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9763