PT-2005-1313 · Mozilla+2 · Firefox+4

Eric Johanson · Published 2005-02-07 · Updated 2022-02-28 · CVE-2005-0233

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Firefox version 1.0 Camino version .8.5 Mozilla versions prior to 1.7.6

Description The issue allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates. This is done by utilizing homograph characters from other character sets, which can facilitate phishing attacks.

Recommendations For Firefox version 1.0, update to a version that includes the fix for this issue. For Camino version .8.5, update to a version that includes the fix for this issue. For Mozilla versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2005-0233

RHSA-2005:176

RHSA-2005_176

RHSA-2005_384

Affected Products

Camino

Firefox

Mozilla Firefox

Opera

Red Hat

References · 64

• 🔥 http://shmoo.com/idn · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Exploit
• 🔥 http://gentoo.org/security/en/glsa/glsa-200503-10.xml · Exploit
• 🔥 http://novell.com/linux/security/advisories/2005_16_mozilla_firefox.html · Exploit
• 🔥 http://mozilla.org/security/announce/mfsa2005-29.html · Exploit
• 🔥 http://shmoo.com/idn/homograph.txt · Exploit
• 🔥 http://gentoo.org/security/en/glsa/glsa-200503-30.xml · Exploit
• http://redhat.com/support/errata/RHSA-2005-384.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0233 · Security Note
• http://redhat.com/support/errata/RHSA-2005-176.html · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2005-0592.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0255.html · Note
• http://securitytracker.com/id?1013301 · Note
• http://mikx.de/firescrolling2 · Note
• https://redhat.com/security/data/cve/CVE-2005-1154.html · Note