PT-2005-1641 · Mozilla+1 · Mozilla Firefox+2

U115577 · Published 2005-02-28 · Updated 2017-10-11 · CVE-2005-0593

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 1.0.1 Mozilla versions prior to 1.7.6

Description The issue allows remote attackers to spoof the SSL secure site lock icon. This can occur in three scenarios: (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.

Recommendations For Firefox versions prior to 1.0.1, update to version 1.0.1 or later to resolve the issue. For Mozilla versions prior to 1.7.6, update to version 1.7.6 or later to resolve the issue.

Fix

Related Identifiers

CVE-2005-0593

RHSA-2005:176

RHSA-2005_176

RHSA-2005_384

Affected Products

Firefox

Mozilla Firefox

Red Hat

References · 63

• https://bugzilla.mozilla.org/show_bug.cgi?id=277564 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200503-30.xml · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=276720 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=258048 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-176.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200503-10.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-384.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=268483 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0593 · Security Note
• https://redhat.com/security/data/cve/CVE-2005-0146.html · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031459.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0527.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0591.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0233.html · Note
• https://redhat.com/security/data/cve/CVE-2005-0586.html · Note