CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
99.7%
Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of SeaMonkey :
CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0074 CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080 CVE-2011-0081 ‘Scoobidiver’, Ian Beer Bob Clary, Henri Sivonen, Marco Bonardo, Mats Palmgren, Jesse Ruderman, Aki Kelin and Martin Barbella discovered memory corruption bugs, which may lead to the execution of arbitrary code.
CVE-2011-0065 CVE-2011-0066 CVE-2011-0073 ‘regenrecht’ discovered several dangling pointer vulnerabilities, which may lead to the execution of arbitrary code.
CVE-2011-0067 Paul Stone discovered that Java applets could steal information from the autocompletion history.
CVE-2011-0071 Soroush Dalili discovered a directory traversal vulnerability in handling resource URIs.
The oldstable distribution (lenny) is not affected. The iceape package only provides the XPCOM code.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory DSA-2227. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(53602);
script_version("1.20");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/04");
script_cve_id("CVE-2011-0065", "CVE-2011-0066", "CVE-2011-0067", "CVE-2011-0069", "CVE-2011-0070", "CVE-2011-0071", "CVE-2011-0072", "CVE-2011-0073", "CVE-2011-0074", "CVE-2011-0075", "CVE-2011-0077", "CVE-2011-0078", "CVE-2011-0080", "CVE-2011-0081");
script_xref(name:"DSA", value:"2227");
script_name(english:"Debian DSA-2227-1 : iceape - several vulnerabilities");
script_summary(english:"Checks dpkg output for the updated package");
script_set_attribute(
attribute:"synopsis",
value:"The remote Debian host is missing a security-related update."
);
script_set_attribute(
attribute:"description",
value:
"Several vulnerabilities have been found in the Iceape internet suite,
an unbranded version of SeaMonkey :
- CVE-2011-0069 CVE-2011-0070 CVE-2011-0072 CVE-2011-0074
CVE-2011-0075 CVE-2011-0077 CVE-2011-0078 CVE-2011-0080
CVE-2011-0081
'Scoobidiver', Ian Beer Bob Clary, Henri Sivonen, Marco
Bonardo, Mats Palmgren, Jesse Ruderman, Aki Kelin and
Martin Barbella discovered memory corruption bugs, which
may lead to the execution of arbitrary code.
- CVE-2011-0065 CVE-2011-0066 CVE-2011-0073
'regenrecht' discovered several dangling pointer
vulnerabilities, which may lead to the execution of
arbitrary code.
- CVE-2011-0067
Paul Stone discovered that Java applets could steal
information from the autocompletion history.
- CVE-2011-0071
Soroush Dalili discovered a directory traversal
vulnerability in handling resource URIs.
The oldstable distribution (lenny) is not affected. The iceape package
only provides the XPCOM code."
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0069"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0070"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0072"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0074"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0075"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0077"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0078"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0080"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0081"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0065"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0066"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0073"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0067"
);
script_set_attribute(
attribute:"see_also",
value:"https://security-tracker.debian.org/tracker/CVE-2011-0071"
);
script_set_attribute(
attribute:"see_also",
value:"https://packages.debian.org/source/squeeze/iceape"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.debian.org/security/2011/dsa-2227"
);
script_set_attribute(
attribute:"solution",
value:
"Upgrade the iceape packages.
For the stable distribution (squeeze), this problem has been fixed in
version 2.0.11-5."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"exploit_framework_core", value:"true");
script_set_attribute(attribute:"exploited_by_malware", value:"true");
script_set_attribute(attribute:"metasploit_name", value:'Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability');
script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
script_set_attribute(attribute:"canvas_package", value:'White_Phosphorus');
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:iceape");
script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");
script_set_attribute(attribute:"patch_publication_date", value:"2011/04/30");
script_set_attribute(attribute:"plugin_publication_date", value:"2011/05/02");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Debian Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
exit(0);
}
include("audit.inc");
include("debian_package.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
flag = 0;
if (deb_check(release:"6.0", prefix:"iceape", reference:"2.0.11-5")) flag++;
if (deb_check(release:"6.0", prefix:"iceape-browser", reference:"2.0.11-5")) flag++;
if (deb_check(release:"6.0", prefix:"iceape-chatzilla", reference:"2.0.11-5")) flag++;
if (deb_check(release:"6.0", prefix:"iceape-dbg", reference:"2.0.11-5")) flag++;
if (deb_check(release:"6.0", prefix:"iceape-dev", reference:"2.0.11-5")) flag++;
if (deb_check(release:"6.0", prefix:"iceape-mailnews", reference:"2.0.11-5")) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
else security_hole(0);
exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0065
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0066
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0067
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0069
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0070
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0071
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0072
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0073
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0074
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0075
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0077
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0078
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0080
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0081
packages.debian.org/source/squeeze/iceape
security-tracker.debian.org/tracker/CVE-2011-0065
security-tracker.debian.org/tracker/CVE-2011-0066
security-tracker.debian.org/tracker/CVE-2011-0067
security-tracker.debian.org/tracker/CVE-2011-0069
security-tracker.debian.org/tracker/CVE-2011-0070
security-tracker.debian.org/tracker/CVE-2011-0071
security-tracker.debian.org/tracker/CVE-2011-0072
security-tracker.debian.org/tracker/CVE-2011-0073
security-tracker.debian.org/tracker/CVE-2011-0074
security-tracker.debian.org/tracker/CVE-2011-0075
security-tracker.debian.org/tracker/CVE-2011-0077
security-tracker.debian.org/tracker/CVE-2011-0078
security-tracker.debian.org/tracker/CVE-2011-0080
security-tracker.debian.org/tracker/CVE-2011-0081
www.debian.org/security/2011/dsa-2227