PT-2006-5358 · Mozilla+2 · Firefox+3
Jon Oberheide
·
Publicado
2006-09-15
·
Atualizado
2018-10-17
·
CVE-2006-4567
CVSS v2.0
2.6
Baixa
| Vetor | AV:N/AC:H/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 1.5.0.7
Thunderbird versions prior to 1.5.0.7
Description
The issue makes it easy for users to accept self-signed certificates for the auto-update mechanism. This might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site. The malicious certificate can then be used to install arbitrary code on the next update.
Recommendations
For Mozilla Firefox versions prior to 1.5.0.7, update to version 1.5.0.7 or later to resolve the issue.
For Thunderbird versions prior to 1.5.0.7, update to version 1.5.0.7 or later to resolve the issue.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Hp-Ux
Firefox
Red Hat
Thunderbird