Vulnerability CVE-2007-3656

Vulnerability CVE-2007-3656

Published: 2007-07-10 Modified: 2012-02-12

Description:

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via (1) HTTP 302 redirect controls, (2) XMLHttpRequest, or (3) view-source URIs.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Firefox wyciwyg:// cache zone bypass	Michal Zalewski	11.07.2007

Type:

CWE-200

(Information Exposure)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.8/10	6.4/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Mozilla -> Firefox

References:

ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

http://lcamtuf.coredump.cx/ffcache/

http://securityreason.com/securityalert/2872

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

http://www.debian.org/security/2007/dsa-1337

http://www.debian.org/security/2007/dsa-1338

http://www.debian.org/security/2007/dsa-1339

http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml

http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

http://www.mozilla.org/security/announce/2007/mfsa2007-24.html

http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

http://www.redhat.com/support/errata/RHSA-2007-0722.html

http://www.redhat.com/support/errata/RHSA-2007-0724.html

http://www.securityfocus.com/archive/1/473191/100/0/threaded

http://www.securityfocus.com/archive/1/474226/100/0/threaded

http://www.securityfocus.com/archive/1/474542/100/0/threaded

http://www.securityfocus.com/bid/24831

http://www.securitytracker.com/id?1018411

http://www.ubuntu.com/usn/usn-490-1

http://www.vupen.com/english/advisories/2007/4256

https://bugzilla.mozilla.org/show_bug.cgi?id=387333

https://exchange.xforce.ibmcloud.com/vulnerabilities/35298

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9105

Vulnerability CVE-2007-3656

See advisories in our WLB2 database:

Low

Firefox wyciwyg:// cache zone bypass

CWE-200

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

6.8/10

6.4/10

8.6/10

Remote

Medium

No required

Partial

Partial

Partial

Affected software

References: