Mozilla Firefox Cookie Verification Denial of Service Vulnerability
BID:62969
Info
Mozilla Firefox Cookie Verification Denial of Service Vulnerability
| Bugtraq ID: | 62969 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2013-6167 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2013 12:00AM |
| Updated: | Oct 21 2013 12:46AM |
| Credit: | Anonymous |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Mozilla Firefox Cookie Verification Denial of Service Vulnerability
Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input.
Successfully exploiting this issue will allow an attacker to inject special characters into the browser's local cookie storage, resulting in the requested website always responding with an error message which is hosted on specific web server software (like lighttpd). This will cause a denial-of-service condition.
Firefox 19 is vulnerable; other versions may also be affected.
Note: This issue was previously covered in BID 58857 (Google Chrome and Mozilla Firefox Browser Cookie Verification Security Weakness), but has been moved to its own record for better documentation.
Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input.
Successfully exploiting this issue will allow an attacker to inject special characters into the browser's local cookie storage, resulting in the requested website always responding with an error message which is hosted on specific web server software (like lighttpd). This will cause a denial-of-service condition.
Firefox 19 is vulnerable; other versions may also be affected.
Note: This issue was previously covered in BID 58857 (Google Chrome and Mozilla Firefox Browser Cookie Verification Security Weakness), but has been moved to its own record for better documentation.
Exploit / POC
Mozilla Firefox Cookie Verification Denial of Service Vulnerability
Attackers can exploit this issue by tricking a victim into viewing a specially crafted webpage.
The following example URI is available:
http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st
Attackers can exploit this issue by tricking a victim into viewing a specially crafted webpage.
The following example URI is available:
http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st
Solution / Fix
Mozilla Firefox Cookie Verification Denial of Service Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Mozilla Firefox Cookie Verification Denial of Service Vulnerability
References:
References:
- Mozilla Firefox Homepage (Mozilla)