PT-2005-1316 · Omni · Omniweb

Eric Johanson · Publicado 2005-02-07 · Atualizado 2017-07-11 · CVE-2005-0236

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Omniweb version 5

Description The issue concerns the International Domain Name (IDN) support, which allows remote attackers to spoof domain names. This is achieved by using punycode encoded domain names that are decoded in URLs and SSL certificates, leveraging homograph characters from other character sets. This facilitates phishing attacks.

Recommendations For Omniweb version 5, consider disabling the IDN support as a temporary workaround until a patch is available. Restrict access to URLs and SSL certificates that use punycode encoded domain names to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0236

Produtos afetados

Omniweb

Referências · 7

• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Exploit
• 🔥 http://shmoo.com/idn · Exploit
• http://shmoo.com/idn/homograph.txt · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19236 · Nota
• http://securityfocus.com/bid/12461 · Nota
• http://marc.info/?l=bugtraq&m=110782704923280&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0236 · Nota de Segurança