CVE-2007-0981

Mozilla Firefox 2.0.0.1 - 'location.hostname' Cross-Domain

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.

Una vulnerabilidad en los navegadores basados ??en Mozilla, incluidos Firefox anterior a versión 1.5.0.10 y versión 2.x anterior a 2.0.0.2, y SeaMonkey anterior a versión 1.0.8, permiten a los atacantes remotos omitir la políticas de mismo origen, robar cookies y conducir otros ataques escribiendo un URI con un byte NULL a la propiedad DOM del host (location.hostname), debido a las interacciones con el código de resolución DNS.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-02-15 CVE Reserved
2007-02-16 CVE Published
2007-02-20 First Exploit
2024-08-07 CVE Updated
2024-08-28 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (60)

URL	Tag	Source
http://secunia.com/advisories/25588	Third Party Advisory
http://securityreason.com/securityalert/2262	Third Party Advisory
http://securitytracker.com/id?1017654	Vdb Entry
http://www.kb.cert.org/vuls/id/885753	Third Party Advisory
http://www.mozilla.org/security/announce/2007/mfsa2007-07.html	X_refsource_confirm
http://www.osvdb.org/32104	Vdb Entry
http://www.securityfocus.com/archive/1/460126/100/200/threaded	Mailing List
http://www.securityfocus.com/archive/1/460217/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/461336/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/461809/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/22566	Vdb Entry
http://www.vupen.com/english/advisories/2007/0624	Vdb Entry
http://www.vupen.com/english/advisories/2007/0718	Vdb Entry
http://www.vupen.com/english/advisories/2008/0083	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/32533	Vdb Entry
https://issues.rpath.com/browse/RPL-1081	X_refsource_confirm
https://issues.rpath.com/browse/RPL-1103	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9730	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/3340	2007-02-20
http://lcamtuf.dione.cc/ffhostname.html	2024-08-07

URL	Date	SRC

URL	Date	SRC
ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc	2018-10-16
ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc	2018-10-16
http://fedoranews.org/cms/node/2713	2018-10-16
http://fedoranews.org/cms/node/2728	2018-10-16
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	2018-10-16
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html	2018-10-16
http://rhn.redhat.com/errata/RHSA-2007-0077.html	2018-10-16
http://secunia.com/advisories/24175	2018-10-16
http://secunia.com/advisories/24205	2018-10-16
http://secunia.com/advisories/24238	2018-10-16
http://secunia.com/advisories/24287	2018-10-16
http://secunia.com/advisories/24290	2018-10-16
http://secunia.com/advisories/24293	2018-10-16
http://secunia.com/advisories/24320	2018-10-16
http://secunia.com/advisories/24328	2018-10-16
http://secunia.com/advisories/24333	2018-10-16
http://secunia.com/advisories/24342	2018-10-16
http://secunia.com/advisories/24343	2018-10-16
http://secunia.com/advisories/24384	2018-10-16
http://secunia.com/advisories/24393	2018-10-16
http://secunia.com/advisories/24395	2018-10-16
http://secunia.com/advisories/24437	2018-10-16
http://secunia.com/advisories/24455	2018-10-16
http://secunia.com/advisories/24457	2018-10-16
http://secunia.com/advisories/24650	2018-10-16
http://security.gentoo.org/glsa/glsa-200703-04.xml	2018-10-16
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131	2018-10-16
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851	2018-10-16
http://www.debian.org/security/2007/dsa-1336	2018-10-16
http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml	2018-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050	2018-10-16
http://www.novell.com/linux/security/advisories/2007_22_mozilla.html	2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0078.html	2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0079.html	2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0097.html	2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0108.html	2018-10-16
http://www.ubuntu.com/usn/usn-428-1	2018-10-16
https://bugzilla.mozilla.org/show_bug.cgi?id=370445	2018-10-16
https://access.redhat.com/security/cve/CVE-2007-0981	2007-03-14
https://bugzilla.redhat.com/show_bug.cgi?id=229253	2007-03-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				<= 1.5.0.9 Search vendor "Mozilla" for product "Firefox" and version " <= 1.5.0.9"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.8 Search vendor "Mozilla" for product "Firefox" and version "0.8"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.9 Search vendor "Mozilla" for product "Firefox" and version "0.9"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.9 Search vendor "Mozilla" for product "Firefox" and version "0.9"		rc		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.9.1 Search vendor "Mozilla" for product "Firefox" and version "0.9.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.9.2 Search vendor "Mozilla" for product "Firefox" and version "0.9.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.9.3 Search vendor "Mozilla" for product "Firefox" and version "0.9.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.10 Search vendor "Mozilla" for product "Firefox" and version "0.10"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				0.10.1 Search vendor "Mozilla" for product "Firefox" and version "0.10.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0 Search vendor "Mozilla" for product "Firefox" and version "1.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.1 Search vendor "Mozilla" for product "Firefox" and version "1.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.2 Search vendor "Mozilla" for product "Firefox" and version "1.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.3 Search vendor "Mozilla" for product "Firefox" and version "1.0.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.4 Search vendor "Mozilla" for product "Firefox" and version "1.0.4"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.5 Search vendor "Mozilla" for product "Firefox" and version "1.0.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.6 Search vendor "Mozilla" for product "Firefox" and version "1.0.6"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.6 Search vendor "Mozilla" for product "Firefox" and version "1.0.6"		linux		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.7 Search vendor "Mozilla" for product "Firefox" and version "1.0.7"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.0.8 Search vendor "Mozilla" for product "Firefox" and version "1.0.8"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5 Search vendor "Mozilla" for product "Firefox" and version "1.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5 Search vendor "Mozilla" for product "Firefox" and version "1.5"		beta1		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5 Search vendor "Mozilla" for product "Firefox" and version "1.5"		beta2		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.1 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.2 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.3 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.4 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.4"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.5 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.6 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.6"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.7 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.7"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.0.8 Search vendor "Mozilla" for product "Firefox" and version "1.5.0.8"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.1 Search vendor "Mozilla" for product "Firefox" and version "1.5.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.2 Search vendor "Mozilla" for product "Firefox" and version "1.5.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.3 Search vendor "Mozilla" for product "Firefox" and version "1.5.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.4 Search vendor "Mozilla" for product "Firefox" and version "1.5.4"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.5 Search vendor "Mozilla" for product "Firefox" and version "1.5.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.6 Search vendor "Mozilla" for product "Firefox" and version "1.5.6"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.7 Search vendor "Mozilla" for product "Firefox" and version "1.5.7"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				1.5.8 Search vendor "Mozilla" for product "Firefox" and version "1.5.8"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				2.0 Search vendor "Mozilla" for product "Firefox" and version "2.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				2.0 Search vendor "Mozilla" for product "Firefox" and version "2.0"		beta_1		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				2.0 Search vendor "Mozilla" for product "Firefox" and version "2.0"		rc3		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				2.0.0.1 Search vendor "Mozilla" for product "Firefox" and version "2.0.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				preview_release Search vendor "Mozilla" for product "Firefox" and version "preview_release"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				<= 1.0.7 Search vendor "Mozilla" for product "Seamonkey" and version " <= 1.0.7"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0 Search vendor "Mozilla" for product "Seamonkey" and version "1.0"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0.1 Search vendor "Mozilla" for product "Seamonkey" and version "1.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0.2 Search vendor "Mozilla" for product "Seamonkey" and version "1.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0.3 Search vendor "Mozilla" for product "Seamonkey" and version "1.0.3"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0.4 Search vendor "Mozilla" for product "Seamonkey" and version "1.0.4"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0.5 Search vendor "Mozilla" for product "Seamonkey" and version "1.0.5"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				1.0.6 Search vendor "Mozilla" for product "Seamonkey" and version "1.0.6"		-		Affected