Mozilla Firefox/SeaMonkey/Thunderbird Site Identity Spoofing Vulnerability
BID:53224
Info
Mozilla Firefox/SeaMonkey/Thunderbird Site Identity Spoofing Vulnerability
| Bugtraq ID: | 53224 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2012-0479 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 24 2012 12:00AM |
| Updated: | Apr 13 2015 09:46PM |
| Credit: | Jeroen van der Gun |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server for VMware 11 SP1 SuSE SUSE Linux Enterprise Server 11 SP2 SuSE SUSE Linux Enterprise Server 11 SP1 SuSE SUSE Linux Enterprise Server 10 SP4 SuSE SUSE Linux Enterprise SDK 11 SP2 SuSE SUSE Linux Enterprise SDK 11 SP1 SuSE SUSE Linux Enterprise SDK 10 SP4 SuSE SUSE Linux Enterprise Desktop 11 SP2 SuSE SUSE Linux Enterprise Desktop 11 SP1 SuSE SUSE Linux Enterprise Desktop 10 SP4 SuSE openSUSE 11.4 Sun Solaris 11 Sun Solaris 10 RedHat Enterprise Linux Optional Productivity Application 5 server RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 Mozilla Thunderbird ESR 10.0.3 Mozilla Thunderbird ESR 10.0.2 Mozilla Thunderbird 9.0 Mozilla Thunderbird 8.0 Mozilla Thunderbird 7.0.1 Mozilla Thunderbird 7.0 Mozilla Thunderbird 6.0.2 Mozilla Thunderbird 6.0.1 Mozilla Thunderbird 6.0 Mozilla Thunderbird 6 Mozilla Thunderbird 6 Mozilla Thunderbird 11.0 Mozilla Thunderbird 10.0.2 Mozilla Thunderbird 10.0.1 Mozilla Thunderbird 10.0 Mozilla Thunderbird 10.0 Mozilla SeaMonkey 2.0.11 Mozilla SeaMonkey 2.0.9 Mozilla SeaMonkey 2.0.8 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.3 Mozilla SeaMonkey 2.0.2 Mozilla SeaMonkey 2.0.1 Mozilla SeaMonkey 2.8 Mozilla SeaMonkey 2.7.2 Mozilla SeaMonkey 2.7.1 Mozilla SeaMonkey 2.7 Mozilla SeaMonkey 2.6 Mozilla SeaMonkey 2.5 Mozilla SeaMonkey 2.4 Mozilla SeaMonkey 2.3 Mozilla SeaMonkey 2.2 Mozilla SeaMonkey 2.1b2 Mozilla SeaMonkey 2.1 Alpha3 Mozilla SeaMonkey 2.1 Alpha2 Mozilla SeaMonkey 2.1 Alpha1 Mozilla SeaMonkey 2.1 Mozilla SeaMonkey 2.0.9 Mozilla SeaMonkey 2.0.7 Mozilla SeaMonkey 2.0.6 Mozilla SeaMonkey 2.0.5 Mozilla SeaMonkey 2.0.4 Mozilla SeaMonkey 2.0.14 Mozilla SeaMonkey 2.0.13 Mozilla SeaMonkey 2.0.12 Mozilla SeaMonkey 2.0.10 Mozilla SeaMonkey 2.0 Rc2 Mozilla SeaMonkey 2.0 Rc1 Mozilla SeaMonkey 2.0 Beta 2 Mozilla SeaMonkey 2.0 Beta 1 Mozilla SeaMonkey 2.0 Alpha 3 Mozilla SeaMonkey 2.0 Alpha 2 Mozilla SeaMonkey 2.0 Alpha 1 Mozilla SeaMonkey 2.0 Mozilla Firefox ESR 10.0.3 Mozilla Firefox ESR 10.0.2 Mozilla Firefox 9.0.1 Mozilla Firefox 9.0 Mozilla Firefox 8.0.1 Mozilla Firefox 8.0 Mozilla Firefox 7.0.1 Mozilla Firefox 7.0 Mozilla Firefox 7 Mozilla Firefox 6.0.2 Mozilla Firefox 6.0.1 Mozilla Firefox 6.0 Mozilla Firefox 6 Mozilla Firefox 5.0.1 Mozilla Firefox 5.0 Mozilla Firefox 11.0 Mozilla Firefox 10.0.2 Mozilla Firefox 10.0.1 Mozilla Firefox 10.0 Mozilla Firefox 10 Moonchild Productions Pale Moon 9.2 Moonchild Productions Pale Moon 9.1 Moonchild Productions Pale Moon 9.0.1 Moonchild Productions Pale Moon 11.0 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Mozilla Thunderbird ESR 10.0.4 Mozilla Thunderbird 12.0 Mozilla SeaMonkey 2.9 Mozilla Firefox ESR 10.0.4 Mozilla Firefox 12.0 Moonchild Productions Pale Moon 12.0 |
Discussion
Mozilla Firefox/SeaMonkey/Thunderbird Site Identity Spoofing Vulnerability
Mozilla Firefox, SeaMonkey, and Thunderbird are affected by a spoofing vulnerability.
Attackers may exploit this issue to spoof the identity of a secure site. Successfully exploiting this issue may aid in phishing attacks.
The issue has been fixed in:
Firefox 12.0
Firefox ESR 10.0.4
Thunderbird 12.0
Thunderbird ESR 10.0.4
SeaMonkey 2.9
Mozilla Firefox, SeaMonkey, and Thunderbird are affected by a spoofing vulnerability.
Attackers may exploit this issue to spoof the identity of a secure site. Successfully exploiting this issue may aid in phishing attacks.
The issue has been fixed in:
Firefox 12.0
Firefox ESR 10.0.4
Thunderbird 12.0
Thunderbird ESR 10.0.4
SeaMonkey 2.9
Exploit / POC
Mozilla Firefox/SeaMonkey/Thunderbird Site Identity Spoofing Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user into visiting a malicious webpage.
To exploit this issue, an attacker must entice an unsuspecting user into visiting a malicious webpage.
References
Mozilla Firefox/SeaMonkey/Thunderbird Site Identity Spoofing Vulnerability
References:
References:
- Cisco NX-OS Download Page (Cisco)
- Mozilla Firefox Homepage (Mozilla)
- Mozilla Homepage (Mozilla Foundation)
- Multiple vulnerabilities in Firefox web browser (Oracle)
- Pale Moon: Release notes 12.0 (Pale Moon)
- SeaMonkey Homepage (Mozilla)
- Potential site identity spoofing when loading RSS and Atom feeds (Mozilla Foundation)