PT-2017-4030 · Mozilla+2 · Firefox+2
Jonathan Kew
·
Publicado
2017-10-15
·
Atualizado
2024-12-12
·
CVE-2017-7832
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 57
Description
The issue allows for domain spoofing attacks by exploiting the display of combined characters in the address bar. Specifically, the dotless version of the letter 'i' followed by an accent can be used to spoof the combined, single character version of the letter 'i' with the same accent in Unicode, such as acute or grave. This is possible because most font sets do not display these combined domain names as punycode. The vulnerability can be exploited by a remote attacker to conduct spoofing attacks.
Recommendations
For Firefox versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially spoofed domains until the update is applied.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu