PT-2004-1853 · Mozilla · Firefox+2

Published 2004-08-14 · Updated 2017-07-11 · CVE-2004-0779

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla versions 1.6 Firebird versions 0.7 Firefox versions 0.8

Description The issue concerns the improper verification of cached passwords for SSL encrypted sites, allowing a remote attacker to cause a cached password to be sent in cleartext to a spoofed site. This occurs because the browsers do not properly ensure that cached passwords are only sent via SSL encrypted sessions to the site.

Recommendations For Mozilla version 1.6, update the browser to a version that properly verifies SSL encrypted sessions for cached passwords. For Firebird version 0.7, update the browser to a version that properly verifies SSL encrypted sessions for cached passwords. For Firefox version 0.8, update the browser to a version that properly verifies SSL encrypted sessions for cached passwords.

Fix

Related Identifiers

CVE-2004-0779

Affected Products

Firebird

Firefox

Mozilla Firefox

References · 5

• http://mandriva.com/security/advisories?name=MDKSA-2004:082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0779 · Security Note
• http://bugzilla.mozilla.org/show_bug.cgi?id=226278 · Note
• http://mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17018 · Note