Signature Detail

HTTP: Mozilla Firefox Dom Property Cookie Theft

This signature detects attempts to exploit a known vulnerability against Mozilla Firefox Location.Hostname. A successful attack can lead to unauthorized information disclosure.

Extended Description

Mozilla Firefox is prone to a vulnerability that allows attackers to steal cookies. This issue occurs because the application fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to manipulate cookie-based authentication credentials for third-party web pages or to control how the site is rendered to the user. Exploiting this issue may allow the attacker to bypass the same-origin policy for cross-window/cross-frame data access; other attacks are also possible. This issue affects version 2.0.0.1; prior versions may also be affected.

Affected Products

• Avaya Messaging Storage Server 1.0
• Avaya Messaging Storage Server 2.0
• Avaya Messaging Storage Server MM3.0
• Avaya Messaging Storage Server
• Debian Linux 3.1.0
• Debian Linux 3.1.0 Alpha
• Debian Linux 3.1.0 Amd64
• Debian Linux 3.1.0 Arm
• Debian Linux 3.1.0 Hppa
• Debian Linux 3.1.0 Ia-32
• Debian Linux 3.1.0 Ia-64
• Debian Linux 3.1.0 M68k
• Debian Linux 3.1.0 Mips
• Debian Linux 3.1.0 Mipsel
• Debian Linux 3.1.0 Ppc
• Debian Linux 3.1.0 S/390
• Debian Linux 3.1.0 Sparc
• Gentoo Linux
• HP HP-UX B.11.11
• HP HP-UX B.11.23
• Mandriva Corporate Server 3.0.0
• Mandriva Corporate Server 3.0.0 X86 64
• Mandriva Corporate Server 4.0
• Mandriva Corporate Server 4.0.0 X86 64
• Mandriva Linux Mandrake 2007.0
• Mandriva Linux Mandrake 2007.0 X86 64
• Mozilla Camino 0.7.0 .0
• Mozilla Camino 0.8.0
• Mozilla Camino 0.8.3
• Mozilla Camino 0.8.4
• Mozilla Camino 1.0
• Mozilla Camino 1.0.1
• Mozilla Camino 1.0.2
• Mozilla Camino 1.0.3
• Mozilla Camino 1.5
• Mozilla Firefox 1.0.0
• Mozilla Firefox 1.0.1
• Mozilla Firefox 1.0.2
• Mozilla Firefox 1.0.3
• Mozilla Firefox 1.0.4
• Mozilla Firefox 1.0.5
• Mozilla Firefox 1.0.6
• Mozilla Firefox 1.0.7
• Mozilla Firefox 1.0.8
• Mozilla Firefox 1.5.0
• Mozilla Firefox 1.5.0.1
• Mozilla Firefox 1.5.0.2
• Mozilla Firefox 1.5.0.3
• Mozilla Firefox 1.5.0.4
• Mozilla Firefox 1.5.0.5
• Mozilla Firefox 1.5.0.6
• Mozilla Firefox 1.5.0.7
• Mozilla Firefox 1.5.0.8
• Mozilla Firefox 1.5.0.9
• Mozilla Firefox 1.5.0 Beta 1
• Mozilla Firefox 1.5.0 Beta 2
• Mozilla Firefox 2.0
• Mozilla Firefox 2.0.0.1
• Mozilla Firefox 2.0 Beta 1
• Mozilla Firefox 2.0 RC2
• Mozilla Firefox 2.0 RC3
• Mozilla SeaMonkey 1.0
• Mozilla SeaMonkey 1.0.1
• Mozilla SeaMonkey 1.0.2
• Mozilla SeaMonkey 1.0.3
• Mozilla SeaMonkey 1.0.5
• Mozilla SeaMonkey 1.0.6
• Mozilla SeaMonkey 1.0.7
• Mozilla SeaMonkey 1.0 Dev
• Red Hat Advanced Workstation for the Itanium Processor 2.1.0
• Red Hat Advanced Workstation for the Itanium Processor 2.1.0 IA64
• Red Hat Desktop 3.0.0
• Red Hat Desktop 4.0.0
• Red Hat Enterprise Linux 5 Server
• Red Hat Enterprise Linux AS 2.1
• Red Hat Enterprise Linux AS 2.1 IA64
• Red Hat Enterprise Linux AS 3
• Red Hat Enterprise Linux AS 4
• Red Hat Enterprise Linux Desktop 5 Client
• Red Hat Enterprise Linux Desktop Workstation 5 Client
• Red Hat Enterprise Linux ES 2.1
• Red Hat Enterprise Linux ES 2.1 IA64
• Red Hat Enterprise Linux ES 3
• Red Hat Enterprise Linux ES 4
• Red Hat Enterprise Linux Optional Productivity Application 5 Server
• Red Hat Enterprise Linux WS 2.1
• Red Hat Enterprise Linux WS 2.1 IA64
• Red Hat Enterprise Linux WS 3
• Red Hat Enterprise Linux WS 4
• Red Hat Fedora Core5
• Red Hat Fedora Core6
• rPath rPath Linux 1
• SGI ProPack 3.0.0 SP6
• Slackware Linux 10.2.0
• Slackware Linux 11.0
• SuSE Linux 10.0 X86
• SuSE Linux 10.1 X86
• SuSE Linux 9.3 X86
• SuSE Novell Linux Desktop 9.0.0
• SuSE Novell Linux POS 9
• SuSE Open-Enterprise-Server
• SuSE openSUSE 10.2
• SuSE SUSE Linux Enterprise Server 8
• SuSE SUSE Linux Enterprise Server 9
• SuSE SuSE Linux Openexchange Server 4.0.0
• SuSE SUSE LINUX Retail Solution 8.0.0
• SuSE SuSE Linux School Server for i386
• SuSE SuSE Linux Standard Server 8.0.0
• SuSE UnitedLinux 1.0.0
• Turbolinux Home
• Turbolinux Multimedia
• Turbolinux Personal
• Turbolinux 10 F...
• Turbolinux FUJI
• Turbolinux Turbolinux Desktop 10.0.0
• Turbolinux Turbolinux Server 10.0.0
• Turbolinux Turbolinux Server 10.0.0 X64
• Turbolinux Turbolinux Server 10.0.0 X86
• Ubuntu Ubuntu Linux 5.10.0 Amd64
• Ubuntu Ubuntu Linux 5.10.0 I386
• Ubuntu Ubuntu Linux 5.10.0 Powerpc
• Ubuntu Ubuntu Linux 5.10.0 Sparc
• Ubuntu Ubuntu Linux 6.10 Amd64
• Ubuntu Ubuntu Linux 6.10 I386
• Ubuntu Ubuntu Linux 6.10 Powerpc
• Ubuntu Ubuntu Linux 6.10 Sparc

References

• BugTraq: 22566
• CVE: CVE-2007-0981