Mozilla Firefox And Thunderbird Long URI Obfuscation Weakness
BID:14526
Info
Mozilla Firefox And Thunderbird Long URI Obfuscation Weakness
| Bugtraq ID: | 14526 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 09 2005 12:00AM |
| Updated: | Aug 09 2005 12:00AM |
| Credit: | "Marc Ruef" <[email protected]> is credited with the discovery of this issue. |
| Vulnerable: |
Mozilla Thunderbird 1.0 Mozilla Firefox 1.0.6 |
| Not Vulnerable: | |
Discussion
Mozilla Firefox And Thunderbird Long URI Obfuscation Weakness
A weakness is reported in Mozilla Firefox and Thunderbird that may allow an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate Web sites in order to steal sensitive information from unsuspecting users.
It is reported that the weakness exists when URIs presented to the vulnerable application are overly long. When a URI as described is displayed, it is reported that the text in the address bar goes completely white, making the URI invisible to the user.
This may facilitate other attacks by hiding the URI from the targeted user.
Mozilla Firefox 1.0.6, and Thunderbird 1.0 are affected by this issue. Other versions and products may also be affected.
A weakness is reported in Mozilla Firefox and Thunderbird that may allow an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate Web sites in order to steal sensitive information from unsuspecting users.
It is reported that the weakness exists when URIs presented to the vulnerable application are overly long. When a URI as described is displayed, it is reported that the text in the address bar goes completely white, making the URI invisible to the user.
This may facilitate other attacks by hiding the URI from the targeted user.
Mozilla Firefox 1.0.6, and Thunderbird 1.0 are affected by this issue. Other versions and products may also be affected.
Exploit / POC
Mozilla Firefox And Thunderbird Long URI Obfuscation Weakness
No exploit is required.
No exploit is required.
Solution / Fix
Mozilla Firefox And Thunderbird Long URI Obfuscation Weakness
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Mozilla Firefox And Thunderbird Long URI Obfuscation Weakness
References:
References: