CVE:CVE-2004-0905
CNNVD:CNNVD-200409-032
Mozilla/Firefox是开放源代码WEB浏览器。
Mozilla/Firefox对URI连接中的拖放处理存在问题，远程攻击者可以利用这个漏洞进行跨域脚本执行攻击。
Mozilla web浏览器允许连接和对象从一个窗口拖放到另一个窗口并没有正确的进行同源策略安全检查，用户可以构建恶意链接，诱使用户处理，可导致恶意程序在其他窗口或域中执行任意程序。
solution:Upgrade mozilla firefox to a higher version than 0.8,0.9,0.9:rc,0.9.1,0.9.2,0.9.3,and avoid the version 0.8,0.9,0.9:rc,0.9.1,0.9.2,0.9.3; Upgrade mozilla mozilla to a higher version than 1.0,1.0:rc1,1.0:rc2,1.0.1,1.0.2,1.1,1.1:alpha,1.1:beta,1.2,1.2:alpha,1.2:beta,1.2.1,1.3,1.3.1,1.4,1.4:alpha,1.4:beta,1.4.1,1.4.2,1.5,1.6,1.7,1.7:rc3,1.7.1,1.7.2,and avoid the version 1.0,1.0:rc1,1.0:rc2,1.0.1,1.0.2,1.1,1.1:alpha,1.1:beta,1.2,1.2:alpha,1.2:beta,1.2.1,1.3,1.3.1,1.4,1.4:alpha,1.4:beta,1.4.1,1.4.2,1.5,1.6,1.7,1.7:rc3,1.7.1,1.7.2; Upgrade netscape navigator to a higher version than 7.0,7.0.2,7.1,7.2,and avoid the version 7.0,7.0.2,7.1,7.2; Upgrade conectiva linux to a higher version than 9.0,10.0,and avoid the version 9.0,10.0; Upgrade redhat enterprise_linux to a higher version than 2.1,3.0,and avoid the version 2.1,3.0; Upgrade redhat enterprise_linux_desktop to a higher version than 3.0,and avoid the version 3.0; Upgrade redhat fedora_core to a higher version than core_1.0,and avoid the version core_1.0; Upgrade redhat linux to a higher version than 7.3,9.0,and avoid the version 7.3,9.0; Upgrade redhat linux_advanced_workstation to a higher version than 2.1,and avoid the version 2.1; Upgrade suse suse_linux to a higher version than 1.0,8,8.1,8.2,9.0,9.1,and avoid the version 1.0,8,8.1,8.2,9.0,9.1