Signature Detail
Short Name |
HTTP:STC:MOZILLA:DUP-LOC-HEADER |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Mozilla Multiple Products Duplicate Location Headers Vulnerability |
Release Date |
2012/11/11 |
Update Number |
2202 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Mozilla Multiple Products Duplicate Location Headers Vulnerability
This signature detects attempts to exploit a known vulnerability in multiple Mozilla products. A vulnerability has been detected in Mozilla Firefox, Thunderbird and SeaMonkey. When multiple Location, Content-Type, Content-Length or Content-Disposition headers are present in an HTTP response, these Mozilla products use the last one, making them more susceptible to newline insertion attacks. An attacker may leverage this vulnerability in conjunction with a vulnerable web application to e.g. redirect target users to malicious URLs.
Extended Description
Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a remote HTTP response-splitting vulnerability. Attackers can leverage this issue to influence or misrepresent how Web content is served, cached, or interpreted. This could aid in various attacks that try to instill client users with a false sense of trust. This issue is fixed in: Firefox 7.0 Firefox 3.6.23 Thunderbird 7.0 SeaMonkey 2.4
Affected Products
- Avaya Aura Presence Services 6.0
- Avaya Aura Presence Services 6.1
- Avaya Aura Presence Services 6.1.1
- Avaya Aura Session Manager 1.0
- Avaya Aura Session Manager 1.1
- Avaya Aura Session Manager 5.2
- Avaya Aura Session Manager 5.2 SP1
- Avaya Aura Session Manager 5.2 SP2
- Avaya Aura Session Manager 6.0
- Avaya Aura Session Manager 6.0 SP1
- Avaya Aura Session Manager 6.1
- Avaya Aura Session Manager 6.1.1
- Avaya Aura Session Manager 6.1.2
- Avaya Aura Session Manager 6.1.3
- Avaya Aura Session Manager 6.1 Sp1
- Avaya Aura Session Manager 6.1 SP2
- Avaya Aura System Manager 5.2
- Avaya Aura System Manager 6.0
- Avaya Aura System Manager 6.0 SP1
- Avaya Aura System Manager 6.1
- Avaya Aura System Manager 6.1.1
- Avaya Aura System Manager 6.1.2
- Avaya Aura System Manager 6.1.3
- Avaya Aura System Manager 6.1 Sp1
- Avaya Aura System Manager 6.1 SP2
- Avaya Communication Server 1000E 7.0
- Avaya Communication Server 1000E 7.5
- Avaya Communication Server 1000M 7.0
- Avaya Communication Server 1000M 7.5
- Avaya IQ 5
- Avaya IQ 5.1
- Avaya IQ 5.1.1
- Avaya IQ 5.2
- Avaya Message Networking 5.2
- Avaya Message Networking 5.2.1
- Avaya Message Networking 5.2.2
- Avaya Message Networking 5.2 SP1
- Avaya Messaging Storage Server 5.0
- Avaya Messaging Storage Server 5.1
- Avaya Messaging Storage Server 5.1 SP1
- Avaya Messaging Storage Server 5.1 SP2
- Avaya Messaging Storage Server 5.2
- Avaya Messaging Storage Server 5.2.2
- Avaya Messaging Storage Server 5.2.8
- Avaya Messaging Storage Server 5.2 SP1
- Avaya Messaging Storage Server 5.2 SP2
- Avaya Messaging Storage Server 5.2 SP3
- Debian Linux 6.0 amd64
- Debian Linux 6.0 arm
- Debian Linux 6.0 ia-32
- Debian Linux 6.0 ia-64
- Debian Linux 6.0 mips
- Debian Linux 6.0 powerpc
- Debian Linux 6.0 s/390
- Debian Linux 6.0 sparc
- Mandriva Enterprise Server 5
- Mandriva Enterprise Server 5 X86 64
- Mandriva Linux Mandrake 2009.0
- Mandriva Linux Mandrake 2009.0 X86 64
- Mandriva Linux Mandrake 2010.1
- Mandriva Linux Mandrake 2010.1 X86 64
- Mandriva Linux Mandrake 2011
- Mandriva Linux Mandrake 2011 x86_64
- Mozilla Firefox 3.6
- Mozilla Firefox 3.6.10
- Mozilla Firefox 3.6.11
- Mozilla Firefox 3.6.12
- Mozilla Firefox 3.6.13
- Mozilla Firefox 3.6.13
- Mozilla Firefox 3.6.14
- Mozilla Firefox 3.6.15
- Mozilla Firefox 3.6.16
- Mozilla Firefox 3.6.17
- Mozilla Firefox 3.6.18
- Mozilla Firefox 3.6.19
- Mozilla Firefox 3.6.2
- Mozilla Firefox 3.6.2
- Mozilla Firefox 3.6.20
- Mozilla Firefox 3.6.3
- Mozilla Firefox 3.6.4
- Mozilla Firefox 3.6.5
- Mozilla Firefox 3.6.6
- Mozilla Firefox 3.6.6
- Mozilla Firefox 3.6.7
- Mozilla Firefox 3.6.8
- Mozilla Firefox 3.6.9
- Mozilla Firefox 3.6 Beta 2
- Mozilla Firefox 3.6 Beta 3
- Mozilla SeaMonkey 2.0
- Mozilla SeaMonkey 2.2
- Mozilla SeaMonkey 2.2
- Mozilla SeaMonkey 2.3
- Mozilla Thunderbird 5
- Mozilla Thunderbird 6
- Mozilla Thunderbird 6
- Oracle Enterprise Linux 6
- Red Hat Enterprise Linux 5 Server
- Red Hat Enterprise Linux Desktop Version 4
- Red Hat Enterprise Linux AS 4
- Red Hat Enterprise Linux Desktop 5 Client
- Red Hat Enterprise Linux Desktop 6
- Red Hat Enterprise Linux Desktop Optional 6
- Red Hat Enterprise Linux Desktop Workstation 5 Client
- Red Hat Enterprise Linux ES 4
- Red Hat Enterprise Linux HPC Node Optional 6
- Red Hat Enterprise Linux Server 6
- Red Hat Enterprise Linux Server Optional 6
- Red Hat Enterprise Linux Workstation 6
- Red Hat Enterprise Linux Workstation Optional 6
- Red Hat Enterprise Linux WS 4
- Red Hat Fedora 14
- Red Hat Fedora 15
- Red Hat Fedora 16
- SuSE openSUSE 11.3
- SuSE openSUSE 11.4
- SuSE SUSE Linux Enterprise Desktop 10 SP4
- SuSE SUSE Linux Enterprise Desktop 11 SP1
- SuSE SUSE Linux Enterprise SDK 10 SP3
- SuSE SUSE Linux Enterprise SDK 10 SP4
- SuSE SUSE Linux Enterprise SDK 11 SP1
- SuSE SUSE Linux Enterprise Server 10 SP3
- SuSE SUSE Linux Enterprise Server 10 SP4
- SuSE SUSE Linux Enterprise Server 11 SP1
- SuSE SUSE Linux Enterprise Server for VMware 11 SP1
- Ubuntu Ubuntu Linux 10.04 Amd64
- Ubuntu Ubuntu Linux 10.04 ARM
- Ubuntu Ubuntu Linux 10.04 I386
- Ubuntu Ubuntu Linux 10.04 Powerpc
- Ubuntu Ubuntu Linux 10.04 Sparc
- Ubuntu Ubuntu Linux 10.10 amd64
- Ubuntu Ubuntu Linux 10.10 ARM
- Ubuntu Ubuntu Linux 10.10 i386
- Ubuntu Ubuntu Linux 10.10 powerpc
- Ubuntu Ubuntu Linux 11.04 amd64
- Ubuntu Ubuntu Linux 11.04 ARM
- Ubuntu Ubuntu Linux 11.04 i386
- Ubuntu Ubuntu Linux 11.04 powerpc
References
- BugTraq: 49849
- CVE: CVE-2011-3000