CVE-2007-2292

Impact

CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
• http://secunia.com/advisories/27276
• http://secunia.com/advisories/27298
• http://secunia.com/advisories/27311
• http://secunia.com/advisories/27315
• http://secunia.com/advisories/27325
• http://secunia.com/advisories/27327
• http://secunia.com/advisories/27335
• http://secunia.com/advisories/27336
• http://secunia.com/advisories/27356
• http://secunia.com/advisories/27360
• http://secunia.com/advisories/27383
• http://secunia.com/advisories/27387
• http://secunia.com/advisories/27403
• http://secunia.com/advisories/27414
• http://secunia.com/advisories/27425
• http://secunia.com/advisories/27480
• http://secunia.com/advisories/27665
• http://secunia.com/advisories/27680
• http://secunia.com/advisories/28398
• http://securityreason.com/securityalert/2654
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
• http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html
• http://www.debian.org/security/2007/dsa-1392
• http://www.debian.org/security/2007/dsa-1396