SECUNIA ADVISORY ID: SA24743

VERIFY ADVISORY: http://secunia.com/advisories/24743/

CRITICAL: Highly critical

IMPACT: Cross Site Scripting, System access

WHERE: >From remote

SOFTWARE: Firebug (Extension for Mozilla Firefox) 1.x - http://secunia.com/product/13856/

DESCRIPTION: pdp has reported a vulnerability in the Firebug extension for Mozilla Firefox, which can be exploited by malicious people to compromise a vulnerable system.

Firebug does not properly sanitise input passed to the "console.log()" function. This can be exploited to e.g. execute arbitrary script code within the "chrome:" context by tricking a user into visiting a malicious website. The vulnerability is reported in versions prior to 1.02.

SOLUTION: Update to version 1.02.

PROVIDED AND/OR DISCOVERED BY: pdp

ORIGINAL ADVISORY:
https://addons.mozilla.org/en-US/firefox/addons/versions/1843
http://www.gnucitizen.org/blog/firebug-goes-evil