Signature Detail

HTTP: Multiple Browser File Upload Keystroke Hijack

This signature detects attempts to exploit a known vulnerability against Multiple Browser. A successful attack can lead to reading arbitrary files.

Extended Description

Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users. This issue is demonstrated to allow attackers to divert keystrokes from one input form in a webpage to a hidden file-upload dialog in the same page. This may allow remote attackers to initiate file uploads from unsuspecting users. Other attacks may also be possible. Exploiting this issue requires that users manually type the full path of files that attackers wish to download. This may require substantial typing from targeted users, so attackers will likely use keyboard-based games, blogs, or other similar pages to entice users to enter the required keyboard input to exploit this issue. Reportedly, Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape Navigator, and Microsoft Internet Explorer are all vulnerable to this issue.

Affected Products

• Debian Iceape 1.0.11
• Debian Linux 4.0
• Debian Linux 4.0 Alpha
• Debian Linux 4.0 Amd64
• Debian Linux 4.0 Arm
• Debian Linux 4.0 Hppa
• Debian Linux 4.0 Ia-32
• Debian Linux 4.0 Ia-64
• Debian Linux 4.0 M68k
• Debian Linux 4.0 Mips
• Debian Linux 4.0 Mipsel
• Debian Linux 4.0 Powerpc
• Debian Linux 4.0 S/390
• Debian Linux 4.0 Sparc
• Foresight Linux 1.1
• Mandriva Corporate Server 3.0.0
• Mandriva Corporate Server 3.0.0 X86 64
• Mandriva Corporate Server 4.0
• Mandriva Corporate Server 4.0.0 X86 64
• Mandriva Linux Mandrake 2006.0.0
• Mandriva Linux Mandrake 2006.0.0 X86 64
• Mandriva Linux Mandrake 2007.1
• Mandriva Linux Mandrake 2007.1 X86 64
• Mandriva Linux Mandrake 2008.0
• Mandriva Linux Mandrake 2008.0 X86 64
• Microsoft Internet Explorer 5.0.1
• Microsoft Internet Explorer 5.5
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 7.0 Beta1
• Microsoft Internet Explorer 7.0 Beta2
• Mozilla Browser 0.8.0
• Mozilla Browser 0.9.2
• Mozilla Browser 0.9.2 .1
• Mozilla Browser 0.9.3
• Mozilla Browser 0.9.35
• Mozilla Browser 0.9.4
• Mozilla Browser 0.9.4 .1
• Mozilla Browser 0.9.48
• Mozilla Browser 0.9.5
• Mozilla Browser 0.9.6
• Mozilla Browser 0.9.7
• Mozilla Browser 0.9.8
• Mozilla Browser 0.9.9
• Mozilla Browser 1.0.0
• Mozilla Browser 1.0.0 RC1
• Mozilla Browser 1.0.0 RC2
• Mozilla Browser 1.0.1
• Mozilla Browser 1.0.2
• Mozilla Browser 1.1.0
• Mozilla Browser 1.1.0 Alpha
• Mozilla Browser 1.1.0 Beta
• Mozilla Browser 1.2.0
• Mozilla Browser 1.2.0 Alpha
• Mozilla Browser 1.2.0 Beta
• Mozilla Browser 1.2.1
• Mozilla Browser 1.3.0
• Mozilla Browser 1.3.1
• Mozilla Browser 1.4.0
• Mozilla Browser 1.4.0 A
• Mozilla Browser 1.4.0 B
• Mozilla Browser 1.4.1
• Mozilla Browser 1.4.2
• Mozilla Browser 1.4.4
• Mozilla Browser 1.5.0
• Mozilla Browser 1.5.1
• Mozilla Browser 1.6.0
• Mozilla Browser 1.7.0
• Mozilla Browser 1.7.0 Alpha
• Mozilla Browser 1.7.0 Beta
• Mozilla Browser 1.7.0 Rc1
• Mozilla Browser 1.7.0 Rc2
• Mozilla Browser 1.7.0 Rc3
• Mozilla Browser 1.7.1
• Mozilla Browser 1.7.10
• Mozilla Browser 1.7.11
• Mozilla Browser 1.7.12
• Mozilla Browser 1.7.13
• Mozilla Browser 1.7.2
• Mozilla Browser 1.7.3
• Mozilla Browser 1.7.4
• Mozilla Browser 1.7.5
• Mozilla Browser 1.7.6
• Mozilla Browser 1.7.7
• Mozilla Browser 1.7.8
• Mozilla Browser 1.7.9
• Mozilla Firefox 0.10.0
• Mozilla Firefox 0.10.1
• Mozilla Firefox 0.8.0
• Mozilla Firefox 0.9.0
• Mozilla Firefox 0.9.0 Rc
• Mozilla Firefox 0.9.1
• Mozilla Firefox 0.9.2
• Mozilla Firefox 0.9.3
• Mozilla Firefox 1.0.0
• Mozilla Firefox 1.0.1
• Mozilla Firefox 1.0.2
• Mozilla Firefox 1.0.3
• Mozilla Firefox 1.0.4
• Mozilla Firefox 1.0.5
• Mozilla Firefox 1.0.6
• Mozilla Firefox 1.0.7
• Mozilla Firefox 1.0.8
• Mozilla Firefox 1.5.0
• Mozilla Firefox 1.5.0.1
• Mozilla Firefox 1.5.0.2
• Mozilla Firefox 1.5.0.3
• Mozilla Firefox 1.5.0.4
• Mozilla Firefox 1.5.0 Beta 1
• Mozilla Firefox 1.5.0 Beta 2
• Mozilla SeaMonkey 1.0
• Mozilla SeaMonkey 1.0.1
• Mozilla SeaMonkey 1.0.2
• Netscape Browser 8.0.3 .3
• Netscape Browser 8.0.4
• Netscape Browser 8.1
• rPath rPath Linux 1
• Slackware Linux 10.2.0
• Slackware Linux 11.0
• Slackware Linux 12.0
• Slackware Linux -Current
• Sun Solaris 10 Sparc
• Sun Solaris 10 X86
• SuSE Linux 10.0 Ppc
• SuSE Linux 10.0 X86
• SuSE Linux 10.0 X86-64
• SuSE Linux 10.1 Ppc
• SuSE Linux 10.1 X86
• SuSE Linux 10.1 X86-64
• SuSE Linux Personal 10.0.0 OSS
• SuSE Linux Personal 10.1
• SuSE Linux Personal 10.2
• SuSE Linux Personal 10.2 X86 64
• SuSE Linux Professional 10.0.0
• SuSE Linux Professional 10.0.0 OSS
• SuSE Linux Professional 10.1
• SuSE Linux Professional 10.2
• SuSE Linux Professional 10.2 X86 64
• SuSE Novell Linux Desktop 9.0.0
• SuSE Novell Linux POS 9
• SuSE Open-Enterprise-Server
• SuSE openSUSE 10.2
• SuSE openSUSE 10.3
• SuSE SUSE Linux Enterprise Desktop 10 SP1
• SuSE SUSE Linux Enterprise Server 10 SP1
• SuSE SUSE Linux Enterprise Server 8
• SuSE SUSE Linux Enterprise Server 9
• SuSE SuSE Linux Openexchange Server 4.0.0
• SuSE SUSE LINUX Retail Solution 8.0.0
• SuSE SuSE Linux School Server for i386
• SuSE SuSE Linux Standard Server 8.0.0
• SuSE UnitedLinux 1.0.0
• Ubuntu Ubuntu Linux 6.06 LTS Amd64
• Ubuntu Ubuntu Linux 6.06 LTS I386
• Ubuntu Ubuntu Linux 6.06 LTS Powerpc
• Ubuntu Ubuntu Linux 6.06 LTS Sparc
• Ubuntu Ubuntu Linux 6.10 Amd64
• Ubuntu Ubuntu Linux 6.10 I386
• Ubuntu Ubuntu Linux 6.10 Powerpc
• Ubuntu Ubuntu Linux 6.10 Sparc
• Ubuntu Ubuntu Linux 7.04 Amd64
• Ubuntu Ubuntu Linux 7.04 I386
• Ubuntu Ubuntu Linux 7.04 Powerpc
• Ubuntu Ubuntu Linux 7.04 Sparc
• Ubuntu Ubuntu Linux 7.10 Amd64
• Ubuntu Ubuntu Linux 7.10 I386
• Ubuntu Ubuntu Linux 7.10 Powerpc
• Ubuntu Ubuntu Linux 7.10 Sparc

References

• BugTraq: 18308
• CVE: CVE-2006-2900