PT-2007-5538 · Mozilla · Firefox

Publicado 2007-08-15 · Atualizado 2018-10-15 · CVE-2007-4357

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 2.0.0.6 and earlier

Description The issue allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. It's worth noting that the severity of this issue has been disputed, as the intended functionality of the status bar allows it to be modified.

Recommendations For Mozilla Firefox versions 2.0.0.6 and earlier, consider disabling the display of the status bar or restricting links to data: URis as a temporary workaround until a fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-4357

Produtos afetados

Firefox

Referências · 8

• 🔥 http://my.opera.com/MichalBucko/blog/firefox-2-0-0-5-uri-encoding-allows-phishing · Exploit
• 🔥 http://eleytt.com/michal.bucko/Eleytt_PhishAGoGo/bucked2.html · Exploit
• http://securityfocus.com/archive/1/475531/100/100/threaded · Nota
• http://securityfocus.com/archive/1/475651/100/0/threaded · Nota
• http://securityfocus.com/archive/1/475467/100/100/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4357 · Nota de Segurança
• http://securityfocus.com/archive/1/476062/100/0/threaded · Nota
• http://securityfocus.com/archive/1/475970/100/0/threaded · Nota