Message-Id: <20051122113646.E0D44B5DED@dsp1>
Date: Tue, 22 Nov 2005 12:36:46 +0100
From: "S. Thommerel" <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: mozilla-firefox: "su root -c firefox" gives root access to any other firefox
 loaded.

Package: mozilla-firefox
Version: 1.0.7-1
Severity: critical
Tags: security
Justification: root security hole



To reproduce this bug:

 su root and then load firefox from the term. Then launch firefox from
 another unrelated and normal user terminal. The newly launched firefox reads root's
 profile and gets root's rights.

 I normally have no rights to save anything in /usr/share with my user
 account. I used firefox as root to go and grab an icon for xfce4 that I
 could save in /usr/share/pixmaps. After that the download tab was the
 only remaining part of root's firefox.
 I loaded firefox (normal user account) and it didn't not show my normal
 homepage. I tried to save google's logo in /usr/share/pixmaps. It
 worked!!!

 

 
-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14
Locale: LANG=C, LC_CTYPE=fr_FR (charmap=ANSI_X3.4-1968) (ignored: LC_ALL set to POSIX)

Versions of packages mozilla-firefox depends on:
ii  debianutils               2.15.1         Miscellaneous utilities specific t
ii  fontconfig                2.3.2-1        generic font configuration library
ii  libatk1.0-0               1.10.3-1       The ATK accessibility toolkit
ii  libc6                     2.3.5-6        GNU C Library: Shared libraries an
ii  libfontconfig1            2.3.2-1        generic font configuration library
ii  libfreetype6              2.1.7-2.4      FreeType 2 font engine, shared lib
ii  libgcc1                   1:4.0.2-2      GCC support library
ii  libglib2.0-0              2.8.3-1        The GLib library of C routines
ii  libgtk2.0-0               2.6.10-1       The GTK+ graphical user interface 
ii  libidl0                   0.8.5-1        library for parsing CORBA IDL file
ii  libjpeg62                 6b-10          The Independent JPEG Group's JPEG 
ii  libkrb53                  1.3.6-5        MIT Kerberos runtime libraries
ii  libpango1.0-0             1.8.2-3        Layout and rendering of internatio
ii  libpng12-0                1.2.8rel-5     PNG library - runtime
ii  libstdc++6                4.0.2-2        The GNU Standard C++ Library v3
ii  libx11-6                  6.8.2.dfsg.1-7 X Window System protocol client li
ii  libxext6                  6.8.2.dfsg.1-7 X Window System miscellaneous exte
ii  libxft2                   2.1.7-1        FreeType-based font drawing librar
ii  libxinerama1              6.8.2.dfsg.1-7 X Window System multi-head display
ii  libxp6                    6.8.2.dfsg.1-7 X Window System printing extension
ii  libxt6                    6.8.2.dfsg.1-7 X Toolkit Intrinsics
ii  psmisc                    21.8-1         Utilities that use the proc filesy
ii  xlibs                     6.8.2.dfsg.1-7 X Window System client libraries m
ii  zlib1g                    1:1.2.3-4      compression library - runtime

mozilla-firefox recommends no packages.

-- no debconf information