Bug 963643 (CVE-2016-1942) - VUL-0: CVE-2016-1942,CVE-2016-1943: MozillaFirefox: Addressbar spoofing attacks
Summary: VUL-0: CVE-2016-1942,CVE-2016-1943: MozillaFirefox: Addressbar spoofing attacks
Status: RESOLVED FIXED
Alias: CVE-2016-1942
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: All openSUSE 42.1
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on: 963520
Blocks:
  Show dependency tree / graph
 
Reported: 2016-01-26 18:21 UTC by Andreas Stieger
Modified: 2020-04-05 18:20 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2016-01-26 18:21:19 UTC 
https://www.mozilla.org/en-US/security/advisories/mfsa2016-09/

Security researcher Jordi Chancel reported two issues involving addressbar spoofing.

The first of these is a "high" rated security issue on on Firefox for Android involving the scrollTo() method to scroll a page. In this attack, scrollTo() is used to scroll the addressbar out of view while replacing it with a fake addressbar created by the attacker when a new tab is opened.

The second flaw is a "low" rated security issue affecting Desktop Firefox. In this attack, when a URL which is invalid for an internal protocol is pasted into the addressbar, the addressbar contents may be manipulated to show the location of an arbitrary website instead of the one currently loaded. This issue is mitigated by the protocol being prepended to the displayed URL, making the address less likely to be confused with the appended URL.

Both of these attacks can lead to potential spoofing by a malicious site.

https://bugzilla.mozilla.org/show_bug.cgi?id=1228590
https://bugzilla.mozilla.org/show_bug.cgi?id=1189082

openSUSE only.
Comment 1 Swamp Workflow Management 2016-01-26 23:00:56 UTC 
bugbot adjusting priority
Comment 2 Andreas Stieger 2016-01-27 10:40:38 UTC 
openSUSE update is running
Comment 3 Andreas Stieger 2016-02-01 21:26:27 UTC 
Releasing updates for openSUSE only bugs.
Comment 4 Swamp Workflow Management 2016-02-02 01:13:43 UTC 
openSUSE-SU-2016:0309-1: An update that fixes 14 vulnerabilities is now available.

Category: security (important)
Bug References: 963633,963634,963635,963637,963641,963643,963644,963645,963731
CVE References: CVE-2015-7208,CVE-2016-1930,CVE-2016-1931,CVE-2016-1933,CVE-2016-1935,CVE-2016-1937,CVE-2016-1938,CVE-2016-1939,CVE-2016-1942,CVE-2016-1943,CVE-2016-1944,CVE-2016-1945,CVE-2016-1946,CVE-2016-1947
Sources used:
openSUSE Leap 42.1 (src):    MozillaFirefox-44.0-12.2, mozilla-nspr-4.11-7.1, mozilla-nss-3.21-9.1
openSUSE 13.2 (src):    MozillaFirefox-44.0-59.1, mozilla-nspr-4.11-12.1, mozilla-nss-3.21-25.1