PT-2006-5358 · Mozilla+2 · Firefox+3
Jon Oberheide
·
Published
2006-09-15
·
Updated
2018-10-17
·
CVE-2006-4567
CVSS v2.0
2.6
Low
| Vector | AV:N/AC:H/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 1.5.0.7
Thunderbird versions prior to 1.5.0.7
Description
The issue makes it easy for users to accept self-signed certificates for the auto-update mechanism. This might allow remote user-assisted attackers to use DNS spoofing to trick users into visiting a malicious site and accepting a malicious certificate for the Mozilla update site. The malicious certificate can then be used to install arbitrary code on the next update.
Recommendations
For Mozilla Firefox versions prior to 1.5.0.7, update to version 1.5.0.7 or later to resolve the issue.
For Thunderbird versions prior to 1.5.0.7, update to version 1.5.0.7 or later to resolve the issue.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Hp-Ux
Firefox
Red Hat
Thunderbird