PT-2008-6573 · Mozilla+2 · Thunderbird+4

Publicado 2008-12-17 · Atualizado 2024-06-15 · CVE-2008-5506

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 3.x before 3.0.5 Mozilla Firefox versions 2.x before 2.0.0.19 Thunderbird versions 2.x before 2.0.0.19 SeaMonkey versions 1.x before 1.1.14

Description The issue allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHttpRequest to an attacker-controlled resource that uses a 302 redirect to a resource in a different domain, then reading content from the response, also known as "response disclosure."

Recommendations For Mozilla Firefox versions 3.x before 3.0.5, update to version 3.0.5 or later. For Mozilla Firefox versions 2.x before 2.0.0.19, update to version 2.0.0.19 or later. For Thunderbird versions 2.x before 2.0.0.19, update to version 2.0.0.19 or later. For SeaMonkey versions 1.x before 1.1.14, update to version 1.1.14 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-5506

DSA-1696-1

DSA-1697-1

DSA-1704-1

DSA-1707-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10601-1

RHSA-2008:1036

RHSA-2008:1037

RHSA-2008_1036

RHSA-2008_1037

RHSA-2009:0002

RHSA-2009_0002

Produtos afetados

Firefox

Red Hat

Seamonkey

Suse

Thunderbird

Referências · 1447

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2018-12374 · Nota