PT-2007-2416 · Mozilla+1 · Firefox+2
Publicado
2007-02-16
·
Atualizado
2024-12-12
·
CVE-2007-0981
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Mozilla based browsers, including Firefox versions prior to 1.5.0.10 and 2.x versions prior to 2.0.0.2
SeaMonkey versions prior to 1.0.8
Description:
The issue allows remote attackers to bypass the same origin policy, potentially leading to cookie theft and other attacks. This is achieved by writing a URI with a null byte to the
location.hostname DOM property, which interacts with DNS resolver code in a way that enables the bypass.Recommendations:
For Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later.
For Firefox 2.x versions prior to 2.0.0.2, update to version 2.0.0.2 or later.
For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Firefox
Red Hat
Seamonkey