medium5.0Public exploit code
CVE-2004-0763
Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mozilla Browser 0.8/0.9/1.x - Refresh Security Property Spoofing2004-07-26 · remote · linux · Verified
- Microsoft Internet Explorer 6 - Meta Data Foreign Domain Spoofing2004-04-30 · remote · windows · Verified
Impact
Mozilla Firefox 0.9.1 and 0.9.2 allows remote web sites to spoof certificates of trusted web sites via redirects and Javascript that uses the "onunload" method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | Versions 0.9.1, 0.9.2 |
References
- NVD record
- CVE.org record
- http://bugzilla.mozilla.org/show_bug.cgi?id=253121
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/024372.html
- http://marc.info/?l=bugtraq&m=109087067730938&w=2
- http://marc.info/?l=bugtraq&m=109900315219363&w=2
- http://secunia.com/advisories/12160/
- http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory
- http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml
- http://www.mozilla.org/projects/security/known-vulnerabilities.html
- http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
- http://www.redhat.com/support/errata/RHSA-2004-421.html
- http://www.securityfocus.com/bid/15495
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16796
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3989
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9436
- http://bugzilla.mozilla.org/show_bug.cgi?id=253121
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/024372.html
- http://marc.info/?l=bugtraq&m=109087067730938&w=2
- http://marc.info/?l=bugtraq&m=109900315219363&w=2
- http://secunia.com/advisories/12160/
- http://www.cipher.org.uk/index.php?p=advisories/Certificate_Spoofing_Mozilla_FireFox_25-07-2004.advisory
- http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml
- http://www.mozilla.org/projects/security/known-vulnerabilities.html
- http://www.novell.com/linux/security/advisories/2004_36_mozilla.html
- http://www.redhat.com/support/errata/RHSA-2004-421.html
- http://www.securityfocus.com/bid/15495