Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-0981

Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.

Published

2007-02-16T01:28:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

10.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	≤ 1.5.0.9	Yes
Application	mozilla	firefox	0.8	Yes
Application	mozilla	firefox	0.9	Yes
Application	mozilla	firefox	0.9	Yes
Application	mozilla	firefox	0.9.1	Yes
Application	mozilla	firefox	0.9.2	Yes
Application	mozilla	firefox	0.9.3	Yes
Application	mozilla	firefox	0.10	Yes
Application	mozilla	firefox	0.10.1	Yes
Application	mozilla	firefox	1.0	Yes
Application	mozilla	firefox	1.0.1	Yes
Application	mozilla	firefox	1.0.2	Yes
Application	mozilla	firefox	1.0.3	Yes
Application	mozilla	firefox	1.0.4	Yes
Application	mozilla	firefox	1.0.5	Yes
Application	mozilla	firefox	1.0.6	Yes
Application	mozilla	firefox	1.0.6	Yes
Application	mozilla	firefox	1.0.7	Yes
Application	mozilla	firefox	1.0.8	Yes
Application	mozilla	firefox	1.5	Yes
Application	mozilla	firefox	1.5	Yes
Application	mozilla	firefox	1.5	Yes
Application	mozilla	firefox	1.5.0.1	Yes
Application	mozilla	firefox	1.5.0.2	Yes
Application	mozilla	firefox	1.5.0.3	Yes
Application	mozilla	firefox	1.5.0.4	Yes
Application	mozilla	firefox	1.5.0.5	Yes
Application	mozilla	firefox	1.5.0.6	Yes
Application	mozilla	firefox	1.5.0.7	Yes
Application	mozilla	firefox	1.5.0.8	Yes
Application	mozilla	firefox	1.5.1	Yes
Application	mozilla	firefox	1.5.2	Yes
Application	mozilla	firefox	1.5.3	Yes
Application	mozilla	firefox	1.5.4	Yes
Application	mozilla	firefox	1.5.5	Yes
Application	mozilla	firefox	1.5.6	Yes
Application	mozilla	firefox	1.5.7	Yes
Application	mozilla	firefox	1.5.8	Yes
Application	mozilla	firefox	2.0	Yes
Application	mozilla	firefox	2.0	Yes
Application	mozilla	firefox	2.0	Yes
Application	mozilla	firefox	2.0.0.1	Yes
Application	mozilla	firefox	preview_release	Yes
Application	mozilla	seamonkey	≤ 1.0.7	Yes
Application	mozilla	seamonkey	1.0	Yes
Application	mozilla	seamonkey	1.0.1	Yes
Application	mozilla	seamonkey	1.0.2	Yes
Application	mozilla	seamonkey	1.0.3	Yes
Application	mozilla	seamonkey	1.0.4	Yes
Application	mozilla	seamonkey	1.0.5	Yes
Application	mozilla	seamonkey	1.0.6	Yes

References

ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc ([email protected])
ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc ([email protected])
http://fedoranews.org/cms/node/2713 ([email protected])
http://fedoranews.org/cms/node/2728 ([email protected])
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 ([email protected])
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 ([email protected])
http://lcamtuf.dione.cc/ffhostname.html Exploit ([email protected])
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html ([email protected])
http://rhn.redhat.com/errata/RHSA-2007-0077.html Vendor Advisory ([email protected])
http://secunia.com/advisories/24175 Vendor Advisory ([email protected])
http://secunia.com/advisories/24205 Vendor Advisory ([email protected])
http://secunia.com/advisories/24238 Vendor Advisory ([email protected])
http://secunia.com/advisories/24287 Vendor Advisory ([email protected])
http://secunia.com/advisories/24290 Vendor Advisory ([email protected])
http://secunia.com/advisories/24293 Vendor Advisory ([email protected])
http://secunia.com/advisories/24320 Vendor Advisory ([email protected])
http://secunia.com/advisories/24328 Vendor Advisory ([email protected])
http://secunia.com/advisories/24333 Vendor Advisory ([email protected])
http://secunia.com/advisories/24342 Vendor Advisory ([email protected])
http://secunia.com/advisories/24343 Vendor Advisory ([email protected])
http://secunia.com/advisories/24384 Vendor Advisory ([email protected])
http://secunia.com/advisories/24393 Vendor Advisory ([email protected])
http://secunia.com/advisories/24395 Vendor Advisory ([email protected])
http://secunia.com/advisories/24437 Vendor Advisory ([email protected])
http://secunia.com/advisories/24455 Vendor Advisory ([email protected])
http://secunia.com/advisories/24457 Vendor Advisory ([email protected])
http://secunia.com/advisories/24650 Vendor Advisory ([email protected])
http://secunia.com/advisories/25588 ([email protected])
http://security.gentoo.org/glsa/glsa-200703-04.xml ([email protected])
http://securityreason.com/securityalert/2262 ([email protected])
http://securitytracker.com/id?1017654 ([email protected])
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131 ([email protected])
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851 ([email protected])
http://www.debian.org/security/2007/dsa-1336 ([email protected])
http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml ([email protected])
http://www.kb.cert.org/vuls/id/885753 US Government Resource ([email protected])
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050 ([email protected])
http://www.mozilla.org/security/announce/2007/mfsa2007-07.html ([email protected])
http://www.novell.com/linux/security/advisories/2007_22_mozilla.html ([email protected])
http://www.osvdb.org/32104 ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0078.html Vendor Advisory ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0079.html Vendor Advisory ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0097.html Vendor Advisory ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0108.html Vendor Advisory ([email protected])
http://www.securityfocus.com/archive/1/460126/100/200/threaded ([email protected])
http://www.securityfocus.com/archive/1/460217/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/461336/100/0/threaded ([email protected])
http://www.securityfocus.com/archive/1/461809/100/0/threaded ([email protected])
http://www.securityfocus.com/bid/22566 ([email protected])
http://www.ubuntu.com/usn/usn-428-1 ([email protected])
http://www.vupen.com/english/advisories/2007/0624 ([email protected])
http://www.vupen.com/english/advisories/2007/0718 ([email protected])
http://www.vupen.com/english/advisories/2008/0083 ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=370445 Vendor Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/32533 ([email protected])
https://issues.rpath.com/browse/RPL-1081 ([email protected])
https://issues.rpath.com/browse/RPL-1103 ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9730 ([email protected])
ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc (af854a3a-2127-422b-91ae-364da2661108)
ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc (af854a3a-2127-422b-91ae-364da2661108)
http://fedoranews.org/cms/node/2713 (af854a3a-2127-422b-91ae-364da2661108)
http://fedoranews.org/cms/node/2728 (af854a3a-2127-422b-91ae-364da2661108)
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 (af854a3a-2127-422b-91ae-364da2661108)
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 (af854a3a-2127-422b-91ae-364da2661108)
http://lcamtuf.dione.cc/ffhostname.html Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html (af854a3a-2127-422b-91ae-364da2661108)
http://rhn.redhat.com/errata/RHSA-2007-0077.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24175 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24205 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24238 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24287 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24290 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24293 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24320 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24328 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24333 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24342 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24343 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24384 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24393 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24395 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24437 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24455 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24457 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24650 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25588 (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200703-04.xml (af854a3a-2127-422b-91ae-364da2661108)
http://securityreason.com/securityalert/2262 (af854a3a-2127-422b-91ae-364da2661108)
http://securitytracker.com/id?1017654 (af854a3a-2127-422b-91ae-364da2661108)
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131 (af854a3a-2127-422b-91ae-364da2661108)
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2007/dsa-1336 (af854a3a-2127-422b-91ae-364da2661108)
http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/885753 US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050 (af854a3a-2127-422b-91ae-364da2661108)
http://www.mozilla.org/security/announce/2007/mfsa2007-07.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.novell.com/linux/security/advisories/2007_22_mozilla.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/32104 (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0078.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0079.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0097.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0108.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/460126/100/200/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/460217/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/461336/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/461809/100/0/threaded (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/22566 (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/usn-428-1 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/0624 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/0718 (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2008/0083 (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.mozilla.org/show_bug.cgi?id=370445 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/32533 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.rpath.com/browse/RPL-1081 (af854a3a-2127-422b-91ae-364da2661108)
https://issues.rpath.com/browse/RPL-1103 (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9730 (af854a3a-2127-422b-91ae-364da2661108)