PT-2005-1313 · Mozilla+2 · Firefox+4

Eric Johanson · Publicado 2005-02-07 · Atualizado 2022-02-28 · CVE-2005-0233

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox version 1.0 Camino version .8.5 Mozilla versions prior to 1.7.6

Description The issue allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates. This is done by utilizing homograph characters from other character sets, which can facilitate phishing attacks.

Recommendations For Firefox version 1.0, update to a version that includes the fix for this issue. For Camino version .8.5, update to a version that includes the fix for this issue. For Mozilla versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2005-0233

RHSA-2005:176

RHSA-2005_176

RHSA-2005_384

Produtos afetados

Camino

Firefox

Mozilla Firefox

Opera

Red Hat

Referências · 64

• 🔥 http://shmoo.com/idn · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Exploit
• 🔥 http://gentoo.org/security/en/glsa/glsa-200503-10.xml · Exploit
• 🔥 http://novell.com/linux/security/advisories/2005_16_mozilla_firefox.html · Exploit
• 🔥 http://mozilla.org/security/announce/mfsa2005-29.html · Exploit
• 🔥 http://shmoo.com/idn/homograph.txt · Exploit
• 🔥 http://gentoo.org/security/en/glsa/glsa-200503-30.xml · Exploit
• https://redhat.com/security/data/cve/CVE-2005-0592.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-0255.html · Nota
• http://securitytracker.com/id?1013301 · Nota
• http://mikx.de/firescrolling2 · Nota
• https://redhat.com/security/data/cve/CVE-2005-1154.html · Nota
• https://redhat.com/security/data/cve/CVE-2005-0146.html · Nota
• http://securityfocus.com/bid/13211 · Nota
• http://redhat.com/support/errata/RHSA-2005-384.html · Aviso do Fabricante