Overview
The Wizz RSS Reader contains a vulnerability that may allow an attacker to take any action that Mozlla Firefox can.
Description
The Mozilla Firefox user interface components outside of the content area are created using chrome. This includes toolbars, menu bars, progress bars, and window title bars. Chrome provides content, locale, and skin information for the user interface. The Wizz RSS reader is an extension to Mozilla Firefox that searches and displays RSS feeds. The Wizz RSS Reader reader contains a vulnerability. This vulnerability occurs because The Wizz allows javascript in an RSS feed's DOM to be executed in the context of the Wizz RSS Reader's chrome window. |
Impact
A remote unauthenticated attacker may be able to take any action that Mozilla Firefox is capable of performing. This includes downloading arbitrary files, redirecting browser requests, and access stored passwords. |
Solution
Upgrade |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 0 | AV:--/AC:--/Au:--/C:--/I:--/A:-- |
| Temporal | 0 | E:ND/RL:ND/RC:ND |
| Environmental | 0 | CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to the N-CIRT Lab for reporting this vulnerability.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | None |
| Severity Metric: | 3.27 |
| Date Public: | 2007-04-13 |
| Date First Published: | 2007-04-16 |
| Date Last Updated: | 2007-04-17 13:49 UTC |
| Document Revision: | 23 |