Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.900513
Category:General
Title:Firefox URL Spoofing And Phising Vulnerability (Windows)
Summary:The host is installed with Mozilla Firefox browser and is prone; to URL spoofing and phising vulnerability.
Description:Summary:
The host is installed with Mozilla Firefox browser and is prone
to URL spoofing and phising vulnerability.

Vulnerability Insight:
Firefox doesn't properly prevent the literal rendering of homoglyph
characters in IDN domain names. This renders the user vulnerable to URL
spoofing and phising attacks as the atatcker may redirect the user to a
different arbitrary malformed website.

Vulnerability Impact:
Successful remote exploitation will let the attacker spoof the URL
information by using homoglyphs of say the /(slash) and ?(question mark)and
can gain sensitive information by redirecting the user to any malicious URL.

Affected Software/OS:
Mozilla Firefox version 3.0.6 and prior on Windows.

Solution:
Upgrade to Mozilla Firefox version 3.6.3 or later

CVSS Score:
5.8

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:P

Cross-Ref: BugTraq ID: 33837
Common Vulnerability Exposure (CVE) ID: CVE-2009-0652
http://www.securityfocus.com/bid/33837
Debian Security Information: DSA-1797 (Google Search)
http://www.debian.org/security/2009/dsa-1797
Debian Security Information: DSA-1830 (Google Search)
http://www.debian.org/security/2009/dsa-1830
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:111
http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike
https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf
http://lists.immunitysec.com/pipermail/dailydave/2009-February/005556.html
http://lists.immunitysec.com/pipermail/dailydave/2009-February/005563.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11396
http://www.redhat.com/support/errata/RHSA-2009-0436.html
RedHat Security Advisories: RHSA-2009:0437
http://rhn.redhat.com/errata/RHSA-2009-0437.html
http://secunia.com/advisories/34096
http://secunia.com/advisories/34843
http://secunia.com/advisories/34844
http://secunia.com/advisories/34894
http://secunia.com/advisories/35042
http://secunia.com/advisories/35065
SuSE Security Announcement: SUSE-SR:2009:010 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
https://usn.ubuntu.com/764-1/
http://www.vupen.com/english/advisories/2009/1125
XForce ISS Database: mozilla-firefox-homoglyph-spoofing(48974)
https://exchange.xforce.ibmcloud.com/vulnerabilities/48974
CopyrightCopyright (C) 2009 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.