PT-2014-3034 · Mozilla+1 · Firefox+1

Reed + 2 · Publicado 2014-02-15 · Atualizado 2014-03-30 · CVE-2013-6167

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28

Description The issue allows remote attackers to conduct a persistent Logout CSRF attack by sending HTTP Cookie headers without proper validation of required character-set restrictions. This can be achieved via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.

Recommendations For Mozilla Firefox versions prior to 28, update to version 28 or later to resolve the issue.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

ALT-PU-2014-1407

CVE-2013-6167

Produtos afetados

Alt Linux

Firefox

Referências · 91

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://exploit-db.com/exploits/38798 · Exploit
• https://bdu.fstec.ru/vul/2014-00280 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00293 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1508 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00254 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=977538 · Nota
• https://bdu.fstec.ru/vul/2014-00241 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00230 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=858215 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1494 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1498 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00248 · Nota de Segurança
• https://bdu.fstec.ru/vul/2014-00264 · Nota de Segurança
• http://seclists.org/oss-sec/2013/q4/117 · Nota