Cross site scripting vulnerabilties in FireFox (rated extremely critical)

[removed]

http://secunia.com/advisories/15292

Description:
Two vulnerabilities have been discovered in Firefox, which can be exploited by
malicious people to conduct cross-site scripting attacks and compromise a user's
system.

1) The problem is that "IFRAME" JavaScript URLs are not properly protected from
being executed in context of another URL in the history list. This can be
exploited to execute arbitrary HTML and script code in a user's browser session
in context of an arbitrary site.

2) Input passed to the "IconURL" parameter in "InstallTrigger.install()" is not
properly verified before being used. This can be exploited to execute arbitrary
JavaScript code with escalated privileges via a specially crafted JavaScript URL.

Successful exploitation requires that the site is allowed to install software
(default sites are "update.mozilla.org" and "addons.mozilla.org").

A combination of vulnerability 1 and 2 can be exploited to execute arbitrary code.

NOTE: Exploit code is publicly available.

The vulnerabilities have been confirmed in version 1.0.3. Other versions may
also be affected.

Solution:
1) Disable JavaScript.

2) Disable software installation: Options --> Web Features --> "Allow web sites
to install software"

NOTE: A temporary solution has been added to the sites "update.mozilla.org" and
"addons.mozilla.org" where requests are redirected to "do-not-add.mozilla.org".
This will stop the publicly available exploit code using a combination of
vulnerability 1 and 2 to execute arbitrary code in the default settings of Firefox.

[Uphaar Agrawalla (uphaar)]

These are already fixed in Firefox 1.0.4. Ubuntu's Firefox (1.0.2-0ubuntu5.3)
has the security fixes backported.
Closing as Fixed.