Mozilla Browser Proxy Server Authentication Credential Disclosure Vulnerability
BID:9326
Info
Mozilla Browser Proxy Server Authentication Credential Disclosure Vulnerability
| Bugtraq ID: | 9326 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 09 2003 12:00AM |
| Updated: | Sep 09 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to the vendor. |
| Vulnerable: |
SCO Open Server 5.0.7 Mozilla Browser 1.4.1 Mozilla Browser 1.4 b Mozilla Browser 1.4 a Mozilla Browser 1.4 Mozilla Browser 1.3.1 Mozilla Browser 1.3 Mozilla Browser 1.2.1 Mozilla Browser 1.2 Beta Mozilla Browser 1.2 Alpha Mozilla Browser 1.2 Mozilla Browser 1.1 Beta Mozilla Browser 1.1 Alpha Mozilla Browser 1.1 Mozilla Browser 1.0.2 Mozilla Browser 1.0.1 Mozilla Browser 1.0 RC2 Mozilla Browser 1.0 RC1 Mozilla Browser 1.0 Mozilla Browser 0.9.48 Mozilla Browser 0.9.35 Mozilla Browser 0.9.9 Mozilla Browser 0.9.8 Mozilla Browser 0.9.7 Mozilla Browser 0.9.6 Mozilla Browser 0.9.5 Mozilla Browser 0.9.4 .1 Mozilla Browser 0.9.4 Mozilla Browser 0.9.3 Mozilla Browser 0.9.2 .1 Mozilla Browser 0.9.2 Mozilla Browser 0.8 Mozilla Browser M16 Mozilla Browser M15 |
| Not Vulnerable: |
Mozilla Browser 1.5 |
Discussion
Mozilla Browser Proxy Server Authentication Credential Disclosure Vulnerability
It has been reported that Mozilla Browser is prone to an information disclosure vulnerability that may allow an attacker to steal user authentication credentials.
The issue presents itself when the user attempts to connect to a malicious server subsequent to successfully authenticating to the trusted server. If the malicious proxy with a same realm as the trusted server sends the user a "407 Proxy authentication required" message, Mozilla will send the cached authentication credentials from the previous exchange with the trusted proxy to the malicious server. This is carried out regardless of the different domain name or IP address of the malicious server.
It has been reported that Mozilla Browser is prone to an information disclosure vulnerability that may allow an attacker to steal user authentication credentials.
The issue presents itself when the user attempts to connect to a malicious server subsequent to successfully authenticating to the trusted server. If the malicious proxy with a same realm as the trusted server sends the user a "407 Proxy authentication required" message, Mozilla will send the cached authentication credentials from the previous exchange with the trusted proxy to the malicious server. This is carried out regardless of the different domain name or IP address of the malicious server.
Exploit / POC
Mozilla Browser Proxy Server Authentication Credential Disclosure Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Mozilla Browser Proxy Server Authentication Credential Disclosure Vulnerability
Solution:
The vendor has released Mozilla 1.5 to address this and other issues.
Mandrake has released an advisory MDKSA-2004:021 to address this issue. Please see the referenced advisory for more information.
SCO has released advisory SCOSA-2004.8 addressing this and other issues. Please see the referenced advisory for further information.
Mozilla Browser 0.8
Mozilla Browser 0.9.2 .1
Mozilla Browser 0.9.2
Mozilla Browser 0.9.3
Mozilla Browser 0.9.35
Mozilla Browser 0.9.4
Mozilla Browser 0.9.4 .1
Mozilla Browser 0.9.48
Mozilla Browser 0.9.5
Mozilla Browser 0.9.6
Mozilla Browser 0.9.7
Mozilla Browser 0.9.8
Mozilla Browser 0.9.9
Mozilla Browser 1.0 RC1
Mozilla Browser 1.0 RC2
Mozilla Browser 1.0
Mozilla Browser 1.0.1
Mozilla Browser 1.0.2
Mozilla Browser 1.1
Mozilla Browser 1.1 Alpha
Mozilla Browser 1.1 Beta
Mozilla Browser 1.2 Alpha
Mozilla Browser 1.2
Mozilla Browser 1.2 Beta
Mozilla Browser 1.2.1
Mozilla Browser 1.3
Mozilla Browser 1.3.1
Mozilla Browser 1.4 b
Mozilla Browser 1.4
Mozilla Browser 1.4 a
SCO Open Server 5.0.7
Solution:
The vendor has released Mozilla 1.5 to address this and other issues.
Mandrake has released an advisory MDKSA-2004:021 to address this issue. Please see the referenced advisory for more information.
SCO has released advisory SCOSA-2004.8 addressing this and other issues. Please see the referenced advisory for further information.
Mozilla Browser 0.8
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.2 .1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.2
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.3
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.35
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.4
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.4 .1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.48
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.5
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.6
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.7
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.8
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 0.9.9
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.0 RC1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.0 RC2
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.0
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.0.1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.0.2
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.1 Alpha
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.1 Beta
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.2 Alpha
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.2
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.2 Beta
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.2.1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.3
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.3.1
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.4 b
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.4
-
Mandrake lib64nspr4-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake lib64nspr4-devel-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake lib64nss3-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake lib64nss3-devel-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libnspr4-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libnspr4-devel-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libnss3-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libnss3-devel-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-devel-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-devel-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-dom-inspector-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-dom-inspector-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-enigmail-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-enigmail-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-enigmime-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-enigmime-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-irc-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-irc-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-js-debugger-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-js-debugger-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-mail-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-mail-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-spellchecker-1.4-13.2.92mdk.amd64.rpm
Mandrakelinux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mozilla-spellchecker-1.4-13.2.92mdk.i586.rpm
Mandrakelinux 9.2
http://www.mandrakesecure.net/en/ftp.php -
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
Mozilla Browser 1.4 a
-
Mozilla Mozilla 1.5
http://www.mozilla.org/download.html
SCO Open Server 5.0.7
-
SCO 507mp3_vol.tar
Read the Maintenance Pack 3 Release and Installation Notes atftp://ftp.sco.com/pub/openserver5/507/mp/mp3/osr507mp3.txt
ftp://ftp.sco.com/pub/openserver5/507/mp/mp3/507mp3_vol.tar
References
Mozilla Browser Proxy Server Authentication Credential Disclosure Vulnerability
References:
References:
- Known Vulnerabilities in Mozilla (Mozilla)
- Mozilla Homepage (Mozilla Foundation)