PT-2011-3801 · Mozilla+2 · Firefox+4

David Chan + 1 · Publicado 2011-06-21 · Atualizado 2024-06-15 · CVE-2011-2362

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.18 Thunderbird versions prior to 3.1.11 SeaMonkey versions prior to 2.0.15

Description The issue allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers, as the software does not distinguish between cookies for two domain names that differ only in a trailing dot.

Recommendations For Mozilla Firefox versions prior to 3.6.18, update to version 3.6.18 or later. For Thunderbird versions prior to 3.1.11, update to version 3.1.11 or later. For SeaMonkey versions prior to 2.0.15, update to version 2.0.15 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-2362

DSA-2268-1

DSA-2269-1

DSA-2273-3

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10230-1

RHSA-2011:0885

RHSA-2011:0886

RHSA-2011:0887

RHSA-2011:0888

RHSA-2011_0885

RHSA-2011_0886

RHSA-2011_0887

RHSA-2011_0888

Produtos afetados

Firefox

Red Hat

Seamonkey

Suse

Thunderbird

Referências · 1590

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• http://support.novell.com/security/cve/CVE-2012-0478.html · Nota