製品・ソフトウェアに関する情報

JVN脆弱性詳細

Mozilla Firefox および SeaMonkey のファイルダウンロードの実装におけるクリックジャッキング攻撃を実行される脆弱性

Title	Mozilla Firefox および SeaMonkey のファイルダウンロードの実装におけるクリックジャッキング攻撃を実行される脆弱性
Summary	Mozilla Firefox および SeaMonkey のファイルダウンロードの実装は、ボタン選択のタイミングを適切に制限しないため、クリックジャッキング攻撃を実行される、およびダウンロードファイルの意図しない起動を誘発される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された Web サイトを介して、クリックジャッキング攻撃を実行される、およびダウンロードファイルの意図しない起動を誘発される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 4, 2014, midnight
Registration Date	Feb. 7, 2014, 5:37 p.m.
Last Update	Feb. 7, 2014, 5:37 p.m.

CVSS2.0 : 警告
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected System

Mozilla Foundation

Mozilla Firefox 27.0 未満

Mozilla SeaMonkey 2.24 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-1480	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1480
National Vulnerability Database (NVD)
2	CVE-2014-1480	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1480

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Mozilla Foundation Security Advisory
1	MFSA2014-03	http://www.mozilla.org/security/announce/2014/mfsa2014-03.html
Mozilla Foundation セキュリティアドバイザリ
2	MFSA2014-03	http://www.mozilla-japan.org/security/announce/2014/mfsa2014-03.html

Change Log

No	Changed Details	Date of change
0	[2014年02月07日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2014-1480

Summary	The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
Publication Date	Feb. 6, 2014, 2:44 p.m.
Registration Date	Jan. 26, 2021, 3:06 p.m.
Last Update	Nov. 21, 2024, 11:04 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::vmware::*
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3::::::
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::-::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:oracle:solaris:11.3:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:mozilla:seamonkey::::::::				2.24
cpe:2.3:a:mozilla:firefox::::::::				27.0

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html	Mailing List Third Party Advisory
7	http://osvdb.org/102867	Broken Link
8	http://osvdb.org/102867	Broken Link
9	http://secunia.com/advisories/56888	Broken Link
10	http://secunia.com/advisories/56888	Broken Link
11	http://www.mozilla.org/security/announce/2014/mfsa2014-03.html	Vendor Advisory
12	http://www.mozilla.org/security/announce/2014/mfsa2014-03.html	Vendor Advisory
13	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
14	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
15	http://www.securityfocus.com/bid/65331	Third Party Advisory VDB Entry
16	http://www.securityfocus.com/bid/65331	Third Party Advisory VDB Entry
17	http://www.securitytracker.com/id/1029717	Third Party Advisory VDB Entry
18	http://www.securitytracker.com/id/1029717	Third Party Advisory VDB Entry
19	http://www.securitytracker.com/id/1029720	Third Party Advisory VDB Entry
20	http://www.securitytracker.com/id/1029720	Third Party Advisory VDB Entry
21	http://www.ubuntu.com/usn/USN-2102-1	Third Party Advisory
22	http://www.ubuntu.com/usn/USN-2102-1	Third Party Advisory
23	http://www.ubuntu.com/usn/USN-2102-2	Third Party Advisory
24	http://www.ubuntu.com/usn/USN-2102-2	Third Party Advisory
25	https://bugzilla.mozilla.org/show_bug.cgi?id=916726	Issue Tracking Vendor Advisory
26	https://bugzilla.mozilla.org/show_bug.cgi?id=916726	Issue Tracking Vendor Advisory
27	https://exchange.xforce.ibmcloud.com/vulnerabilities/90897	Third Party Advisory VDB Entry
28	https://exchange.xforce.ibmcloud.com/vulnerabilities/90897	Third Party Advisory VDB Entry
29	https://security.gentoo.org/glsa/201504-01	Third Party Advisory
30	https://security.gentoo.org/glsa/201504-01	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-1021	レンダリングされたユーザインターフェースレイヤまたはフレームの不適切な制限	https://cwe.mitre.org/data/definitions/1021.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::vmware::*
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3::::::
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::-::*