Mozilla Suite/Firefox HTTP Authentication Dialogs Tab Focus Vulnerability

BID:12728

Info

Mozilla Suite/Firefox HTTP Authentication Dialogs Tab Focus Vulnerability

Bugtraq ID: 12728
Class: Design Error
CVE: CVE-2005-0584
Remote: Yes
Local: No
Published: Feb 28 2005 12:00AM
Updated: Jul 12 2009 10:56AM
Credit: Discovery of this vulnerability is credited to Christian Schmidt <[email protected]>. Juha-Matti Laurio reported that this issue also affects Netscape and K-Meleon.
Vulnerable: SGI ProPack 3.0
Redhat Linux 9.0 i386
Redhat Linux 7.3 i686
Redhat Linux 7.3 i386
Redhat Linux 7.3
Redhat Fedora Core3
Redhat Fedora Core2
Redhat Fedora Core1
Netscape Netscape 7.2
Netscape Netscape 7.1
Netscape Netscape 7.0
Mozilla Thunderbird 1.0.1
Mozilla Thunderbird 1.0
Mozilla Thunderbird 0.9
Mozilla Thunderbird 0.8
Mozilla Thunderbird 0.7.3
Mozilla Thunderbird 0.7.2
Mozilla Thunderbird 0.7.1
Mozilla Thunderbird 0.7
Mozilla Thunderbird 0.6
Mozilla Firefox 1.0
+ Gentoo Linux
+ Gentoo Linux
+ S.u.S.E. Linux Personal 9.2 x86_64
 + S.u.S.E. Linux Personal 9.2 x86_64
 + S.u.S.E. Linux Personal 9.2
+ S.u.S.E. Linux Personal 9.2
+ S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1 x86_64
 + S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.0 x86_64
 + S.u.S.E. Linux Personal 9.0 x86_64
 + S.u.S.E. Linux Personal 9.0
+ S.u.S.E. Linux Personal 9.0
+ Slackware Linux 10.1
+ Slackware Linux 10.0
+ Slackware Linux 10.0
+ Slackware Linux 9.1
+ Slackware Linux 9.1
+ Slackware Linux -current
 + Slackware Linux -current
 Mozilla Firefox 0.10.1
Mozilla Firefox 0.10
Mozilla Firefox 0.9.3
Mozilla Firefox 0.9.2
Mozilla Firefox 0.9.1
Mozilla Firefox 0.9 rc
Mozilla Firefox 0.9
Mozilla Firefox 0.8
Mozilla Browser 1.7.5
+ HP Tru64 5.1 B-2 PK4 (BL25)
 + HP Tru64 5.1 B-2 PK4
 + HP Tru64 5.1 B-2 PK4
 + HP Tru64 5.1 B PK4
 + HP Tru64 5.1 B PK4
 + HP Tru64 5.1 A PK6 (BL24)
 + HP Tru64 5.1 A PK6 (BL24)
 + HP Tru64 5.1 A PK6
 + HP Tru64 5.1 A PK6
 Mozilla Browser 1.7.4
Mozilla Browser 1.7.3
+ HP HP-UX B.11.23
 + HP HP-UX B.11.22
 + HP HP-UX B.11.22
 + HP HP-UX B.11.11
 + HP HP-UX B.11.11
 + HP HP-UX B.11.11
 + HP HP-UX B.11.11
 + HP HP-UX B.11.00
 + HP HP-UX B.11.00
 + HP Tru64 5.1 B-2 PK4 (BL25)
 + HP Tru64 5.1 B-2 PK4 (BL25)
 + HP Tru64 5.1 B-2 PK4
 + HP Tru64 5.1 B-2 PK4
 + HP Tru64 5.1 B PK4
 + HP Tru64 5.1 B PK4
 + HP Tru64 5.1 A PK6 (BL24)
 + HP Tru64 5.1 A PK6 (BL24)
 + HP Tru64 5.1 A PK6
 + HP Tru64 5.1 A PK6
 Mozilla Browser 1.7.2
Mozilla Browser 1.7.1
Mozilla Browser 1.7 rc3
Mozilla Browser 1.7 rc2
Mozilla Browser 1.7 rc1
Mozilla Browser 1.7 beta
Mozilla Browser 1.7 alpha
Mozilla Browser 1.7
K-Meleon K-Meleon 0.9
HP HP-UX B.11.23
HP HP-UX B.11.22
HP HP-UX B.11.11
HP HP-UX B.11.00
Gentoo Linux
Not Vulnerable: Netscape Netscape 8.0
Mozilla Thunderbird 1.0.1
Mozilla Firefox 1.0.1
+ Redhat Fedora Core3
 Mozilla Browser 1.7.6
+ HP HP-UX B.11.23
 + HP HP-UX B.11.23
 + HP HP-UX B.11.22
 + HP HP-UX B.11.22
 + HP HP-UX B.11.11
 + HP HP-UX B.11.11
 + HP HP-UX B.11.11
 + HP HP-UX B.11.11
 + HP HP-UX B.11.00
 + HP HP-UX B.11.00
 + Redhat Desktop 4.0
+ Redhat Desktop 4.0
+ Redhat Enterprise Linux AS 4
 + Redhat Enterprise Linux AS 4
 + Redhat Enterprise Linux ES 4
 + Redhat Enterprise Linux ES 4
 + Redhat Enterprise Linux WS 4
 + Redhat Enterprise Linux WS 4
 + Turbolinux Home
+ Turbolinux Home
+ Turbolinux Turbolinux 10 F...
 + Turbolinux Turbolinux Desktop 10.0
+ Turbolinux Turbolinux Desktop 10.0
+ Turbolinux Turbolinux Server 10.0
+ Turbolinux Turbolinux Server 10.0

Discussion

Mozilla Suite/Firefox HTTP Authentication Dialogs Tab Focus Vulnerability

Mozilla Suite and Mozilla Firefox are reported prone to a vulnerability that may result in the loss of authentication credentials. It is reported that HTTP authentication dialogs do not remain focused for the tab that invoked the dialog, rather the dialog focuses over the active tab.

A remote attacker may potentially exploit this condition to aid in phishing attacks.

This vulnerability is reported to affect Firefox versions prior to version 1.0.1 and Mozilla Suite versions prior to version 1.7.6.

Netscape 7.2 is reportedly vulnerable to this issue as well. It is also possible that other versions of Netscape are affected.

K-Meleon 0.9 is affected by this vulnerability as well. Other versions could also be vulnerable.

Exploit / POC

Mozilla Suite/Firefox HTTP Authentication Dialogs Tab Focus Vulnerability

A proof of concept is available at the following location:

https://bugzilla.mozilla.org/attachment.cgi?id=170683

Solution / Fix

Mozilla Suite/Firefox HTTP Authentication Dialogs Tab Focus Vulnerability

Solution:
The vendor has released upgrades for Firefox dealing with this issue. Mozilla has reported that a pending release of Mozilla Suite 1.7.6 will be released dealing with this issue in the near future. This BID will be updated upon release.

Gentoo has released an advisory (GLSA 200503-10) and updated eBuilds to address this vulnerability. Gentoo users that are running the affected software may apply the update by issuing the following sequence of commands as a superuser:

For Firefox users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-1.0.1"

For Firefox binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=net-www/mozilla-firefox-bin-1.0.1"

Fedora advisory FEDORA-2005-249 is available to address this issue in Mozilla browser for Fedora Core 3. Please see the referenced advisory for more information.

Gentoo has released advisory GLSA 200503-30 to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

Mozilla Suite users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.6"

Mozilla Suite binary users:
emerge --sync
emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.6"

SGI has released an advisory 20050501-01-U including updated SGI ProPack 3 Service Pack 5 packages to address this BID and other issues. Please see the referenced advisory for more information.

It was reported that the K-Meleon engine can be upgraded with Mozilla Suite 1.7.7 nightly version. This has not been confirmed.

RedHat Fedora Legacy has released advisory FLSA:152883 addressing this and other issues for RedHat Linux 7.3, 9 and for Fedora Core 1 and Core 2. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Netscape Browser 8.0 has been released to address various security issues. Please see the vendor advisory in Web references for more information.

HP advisory HPSBUX01133 (SSRT5940 rev.1 - HP-UX Mozilla remote, unauthorized user may execute privileged code) is available to address various issues affecting Mozilla. Please see the referenced advisory for more information.


Mozilla Firefox 0.10

Mozilla Firefox 0.10.1

Mozilla Firefox 0.8

Mozilla Firefox 0.9

Mozilla Firefox 0.9 rc

Mozilla Firefox 0.9.1

Mozilla Firefox 0.9.2

Mozilla Firefox 0.9.3

Mozilla Firefox 1.0

Mozilla Browser 1.7.3

Netscape Netscape 7.0

Netscape Netscape 7.1

Netscape Netscape 7.2

References

Mozilla Suite/Firefox HTTP Authentication Dialogs Tab Focus Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report