Mozilla Firefox CVE-2013-1699 Homograph Domain Spoofing Vulnerability

Bugtraq ID:	60785
Class:	Input Validation Error
CVE:	CVE-2013-1699
Remote:	Yes
Local:	No
Published:	Jun 25 2013 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	3ric Johanson
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Mozilla Firefox 9.0.1 Mozilla Firefox 9.0 Mozilla Firefox 8.0.1 Mozilla Firefox 8.0 Mozilla Firefox 7.0.1 Mozilla Firefox 7.0 Mozilla Firefox 7 Mozilla Firefox 13.0 Mozilla Firefox 12.0 Mozilla Firefox 11.0 Mozilla Firefox 10.0.2 Mozilla Firefox 10.0.1 Mozilla Firefox 10.0 Mozilla Firefox 10
Not Vulnerable:

Mozilla Firefox CVE-2013-1699 Homograph Domain Spoofing Vulnerability

Mozilla Firefox is prone to a domain-spoofing vulnerability because it fails to adequately handle homographs in international domain name (IDN) domains.

An attacker may leverage this issue to spoof a domain that visually resembles a legitimate domain. This may lead to a false sense of trust because the user may be presented with a URI of a seemingly trusted domain while interacting with the attacker's malicious site.

Note: This issue was previously discussed in BID 60762 (Mozilla Firefox/Thunderbird MFSA 2013-49 through -62 Multiple Vulnerabilities), but has been moved to its own record for better documentation.

Versions prior to Mozilla Firefox 22.0 are vulnerable.

Mozilla Firefox CVE-2013-1699 Homograph Domain Spoofing Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mozilla Firefox CVE-2013-1699 Homograph Domain Spoofing Vulnerability

References:

• Mozilla Firefox Homepage (Mozilla)