National Cyber Awareness System

Vulnerability Summary for CVE-2007-3656

Overview

Mozilla Firefox before 1.8.0.13 and 1.8.1.x before 1.8.1.5 does not perform a security zone check when processing a wyciwyg URI, which allows remote attackers to obtain sensitive information, poison the browser cache, and possibly enable further attack vectors via (1) HTTP 302 redirect controls, (2) XMLHttpRequest, or (3) view-source URIs.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.mozilla.org/show_bug.cgi?id=387333

Hyperlink:https://bugzilla.mozilla.org/show_bug.cgi?id=387333

External Source: XF

Name: mozilla-wyciwyg-security-bypass(35298)

Hyperlink:http://xforce.iss.net/xforce/xfdb/35298

External Source: VUPEN

Name: ADV-2007-4256

Hyperlink:http://www.vupen.com/english/advisories/2007/4256

External Source: BID

Name: 24831

Hyperlink:http://www.securityfocus.com/bid/24831

External Source: BUGTRAQ

Name: 20070709 Firefox wyciwyg:// cache zone bypass

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/473191/100/0/threaded

External Source: OVAL

Name: oval:org.mitre.oval:def:9105

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9105

External Source: OSVDB

Name: 38028

Hyperlink:http://osvdb.org/38028

External Source: MISC

Name: http://lcamtuf.coredump.cx/ffcache/

Hyperlink:http://lcamtuf.coredump.cx/ffcache/

External Source: HP

Name: HPSBUX02153

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: HP

Name: HPSBUX02153

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

External Source: UBUNTU

Name: USN-490-1

Hyperlink:http://www.ubuntu.com/usn/usn-490-1

External Source: SECTRACK

Name: 1018411

Hyperlink:http://www.securitytracker.com/id?1018411

External Source: BUGTRAQ

Name: 20070724 FLEA-2007-0033-1: firefox thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/474542/100/0/threaded

External Source: BUGTRAQ

Name: 20070720 rPSA-2007-0148-1 firefox thunderbird

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/474226/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0724

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0724.html

External Source: REDHAT

Name: RHSA-2007:0722

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0722.html

External Source: SUSE

Name: SUSE-SA:2007:049

Hyperlink:http://www.novell.com/linux/security/advisories/2007_49_mozilla.html

External Source: CONFIRM

Name: http://www.mozilla.org/security/announce/2007/mfsa2007-24.html

Hyperlink:http://www.mozilla.org/security/announce/2007/mfsa2007-24.html

External Source: MANDRIVA

Name: MDKSA-2007:152

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:152

External Source: GENTOO

Name: GLSA-200708-09

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml

External Source: DEBIAN

Name: DSA-1339

Hyperlink:http://www.debian.org/security/2007/dsa-1339

External Source: DEBIAN

Name: DSA-1338

Hyperlink:http://www.debian.org/security/2007/dsa-1338

External Source: DEBIAN

Name: DSA-1337

Hyperlink:http://www.debian.org/security/2007/dsa-1337

External Source: CONFIRM

Name: http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

Hyperlink:http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html

External Source: SUNALERT

Name: 201516

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1

External Source: SUNALERT

Name: 103177

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1

External Source: SREASON

Name: 2872

Hyperlink:http://securityreason.com/securityalert/2872

External Source: SECUNIA

Name: 28135

Hyperlink:http://secunia.com/advisories/28135

External Source: SECUNIA

Name: 26460

Hyperlink:http://secunia.com/advisories/26460

External Source: SECUNIA

Name: 26271

Hyperlink:http://secunia.com/advisories/26271

External Source: SECUNIA

Name: 26258

Hyperlink:http://secunia.com/advisories/26258

External Source: SECUNIA

Name: 26216

Hyperlink:http://secunia.com/advisories/26216

External Source: SECUNIA

Name: 26211

Hyperlink:http://secunia.com/advisories/26211

External Source: SECUNIA

Name: 26205

Hyperlink:http://secunia.com/advisories/26205

External Source: SECUNIA

Name: 26204

Hyperlink:http://secunia.com/advisories/26204

External Source: SECUNIA

Name: 26179

Hyperlink:http://secunia.com/advisories/26179

External Source: SECUNIA

Name: 26159

Hyperlink:http://secunia.com/advisories/26159

External Source: SECUNIA

Name: 26151

Hyperlink:http://secunia.com/advisories/26151

External Source: SECUNIA

Name: 26149

Hyperlink:http://secunia.com/advisories/26149

External Source: SECUNIA

Name: 26107

Hyperlink:http://secunia.com/advisories/26107

External Source: SECUNIA

Name: 26103

Hyperlink:http://secunia.com/advisories/26103

External Source: SECUNIA

Name: 26072

Hyperlink:http://secunia.com/advisories/26072

External Source: SECUNIA

Name: 25990

Hyperlink:http://secunia.com/advisories/25990

External Source: SECUNIA

Name: 25589

Hyperlink:http://secunia.com/advisories/25589

External Source: SGI

Name: 20070701-01-P

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc

External Source: CONFIRM

Name: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

Hyperlink:ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt

References to Check Content

Identifier:oval:org.mitre.oval:def:9105

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9105