PT-2004-1853 · Mozilla · Firefox+2

Publicado 2004-08-14 · Atualizado 2017-07-11 · CVE-2004-0779

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla versions 1.6 Firebird versions 0.7 Firefox versions 0.8

Description The issue concerns the improper verification of cached passwords for SSL encrypted sites, allowing a remote attacker to cause a cached password to be sent in cleartext to a spoofed site. This occurs because the browsers do not properly ensure that cached passwords are only sent via SSL encrypted sessions to the site.

Recommendations For Mozilla version 1.6, update the browser to a version that properly verifies SSL encrypted sessions for cached passwords. For Firebird version 0.7, update the browser to a version that properly verifies SSL encrypted sessions for cached passwords. For Firefox version 0.8, update the browser to a version that properly verifies SSL encrypted sessions for cached passwords.

Correção

Identificadores relacionados

CVE-2004-0779

Produtos afetados

Firebird

Firefox

Mozilla Firefox

Referências · 5

• http://mandriva.com/security/advisories?name=MDKSA-2004:082 · Aviso do Fabricante
• http://bugzilla.mozilla.org/show_bug.cgi?id=226278 · Nota
• http://mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0779 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17018 · Nota