Mozilla Firefox Error Handling Information Disclosure Vulnerability

Bugtraq ID:	40401
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2010 12:00AM
Updated:	May 27 2010 12:00AM
Credit:	Soroush Dalili
Vulnerable:	Mozilla Firefox 3.6.3 Mozilla Firefox 3.5.9
Not Vulnerable:

Mozilla Firefox Error Handling Information Disclosure Vulnerability

Mozilla Firefox is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may aid in further attacks.

The issue affects Mozilla Firefox 3.6.3 and 3.5.9; other versions may also be affected.

Mozilla Firefox Error Handling Information Disclosure Vulnerability

The researcher who discovered the issue, created a working proof-of-concept. The script is available at:

hxxp://0me.me/demo/XSUH/XSUH_demo_firefox_all_in_1.html

Mozilla Firefox Error Handling Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Mozilla Firefox Error Handling Information Disclosure Vulnerability

References:

• Cross Site URL Hijacking by using Error Object in Mozilla Firefox (Soroush Dalili)
  
• Mozilla Homepage (Mozilla Foundation)