PT-2011-3801 · Mozilla+2 · Firefox+4

David Chan + 1 · Published 2011-06-21 · Updated 2024-06-15 · CVE-2011-2362

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.6.18 Thunderbird versions prior to 3.1.11 SeaMonkey versions prior to 2.0.15

Description The issue allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers, as the software does not distinguish between cookies for two domain names that differ only in a trailing dot.

Recommendations For Mozilla Firefox versions prior to 3.6.18, update to version 3.6.18 or later. For Thunderbird versions prior to 3.1.11, update to version 3.1.11 or later. For SeaMonkey versions prior to 2.0.15, update to version 2.0.15 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-2362

DSA-2268-1

DSA-2269-1

DSA-2273-3

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10230-1

RHSA-2011:0885

RHSA-2011:0886

RHSA-2011:0887

RHSA-2011:0888

RHSA-2011_0885

RHSA-2011_0886

RHSA-2011_0887

RHSA-2011_0888

Affected Products

Firefox

Red Hat

Seamonkey

Suse

Thunderbird

References · 1590

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://bdu.fstec.ru/vul/2015-06203 · Security Note