PT-2007-2416 · Mozilla+1 · Firefox+2
Published
2007-02-16
·
Updated
2024-12-12
·
CVE-2007-0981
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Mozilla based browsers, including Firefox versions prior to 1.5.0.10 and 2.x versions prior to 2.0.0.2
SeaMonkey versions prior to 1.0.8
Description:
The issue allows remote attackers to bypass the same origin policy, potentially leading to cookie theft and other attacks. This is achieved by writing a URI with a null byte to the
location.hostname DOM property, which interacts with DNS resolver code in a way that enables the bypass.Recommendations:
For Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later.
For Firefox 2.x versions prior to 2.0.0.2, update to version 2.0.0.2 or later.
For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Firefox
Red Hat
Seamonkey