Vulnerability CVE-2009-2654

Vulnerability CVE-2009-2654

Published: 2009-08-03 Modified: 2012-02-13

Description:

Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	URL spoofing bug involving Firefox\'s error pages and document.write	Juan Pablo Lopez...	04.08.2009

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
5.8/10	4.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	Partial

Affected software
Mozilla -> Firefox

References:

http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/

http://es.geocities.com/jplopezy/firefoxspoofing.html

http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1

http://www.debian.org/security/2009/dsa-1873

http://www.mozilla.org/security/announce/2009/mfsa2009-44.html

http://www.redhat.com/support/errata/RHSA-2009-1430.html

http://www.redhat.com/support/errata/RHSA-2009-1431.html

http://www.redhat.com/support/errata/RHSA-2009-1432.html

http://www.securityfocus.com/archive/1/505242/30/0/threaded

http://www.securityfocus.com/archive/1/505265

http://www.securityfocus.com/bid/35803

http://www.securitytracker.com/id?1022603

http://www.vupen.com/english/advisories/2009/2006

http://www.vupen.com/english/advisories/2009/2142

https://bugzilla.mozilla.org/show_bug.cgi?id=451898

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9686

https://usn.ubuntu.com/811-1/

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00198.html

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00261.html

Vulnerability CVE-2009-2654

See advisories in our WLB2 database:

Low

URL spoofing bug involving Firefox\'s error pages and document.write

CWE-20

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:P)

5.8/10

4.9/10

8.6/10

Remote

Medium

No required

None

Partial

Partial

Affected software

References: