PT-2015-4901 · Mozilla+3 · Firefox+3

Muneaki Nishimura

+1

·

Publicado

2015-02-24

·

Atualizado

2024-12-12

·

CVE-2015-0832

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 36.0
Description The issue arises from the improper recognition of domain name equivalence with and without a trailing dot character, allowing man-in-the-middle attackers to bypass HPKP and HSTS protection mechanisms. This is achieved by constructing a URL with the trailing dot character and leveraging access to an X.509 certificate for a domain with this character.
Recommendations For versions prior to 36.0, update to version 36.0 or later to resolve the issue.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

ALT-PU-2015-1275
ALT-PU-2015-1464
CVE-2015-0832
MGASA-2015-0126
OPENSUSE-SU-2015_0404-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
USN-2505-1
USN-2505-2

Produtos afetados

Alt Linux
Firefox
Suse
Ubuntu