CVE-2007-5337

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5, when running on Linux systems with gnome-vfs support, might allow remote attackers to read arbitrary files on SSH/sftp servers that accept key authentication by creating a web page on the target server, in which the web page contains URIs with (1) smb: or (2) sftp: schemes that access other files from the server.

El Mozilla Firefox anterior al 2.0.0.8 y el SeaMonkey anterior al 1.1.5, cuando corren bajo sistemas Linux con el soporte gnome-vfs, puede permitir a atacantes remotos leer ficheros de su elección en servidores SSH/sftp que aceptan la clave de autenticación mediante la creación de una página web en el servidor objetivo, en donde la página web contenga URIs con esquemas (1) smb: o (2) sftp: que acceden a otros ficheros del servidor.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-10-10 CVE Reserved
2007-10-21 CVE Published
2024-08-07 CVE Updated
2024-08-24 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (49)

URL	Tag	Source
http://secunia.com/advisories/27276	Third Party Advisory
http://secunia.com/advisories/27298	Third Party Advisory
http://secunia.com/advisories/27325	Third Party Advisory
http://secunia.com/advisories/27327	Third Party Advisory
http://secunia.com/advisories/27335	Third Party Advisory
http://secunia.com/advisories/27336	Third Party Advisory
http://secunia.com/advisories/27356	Third Party Advisory
http://secunia.com/advisories/27360	Third Party Advisory
http://secunia.com/advisories/27383	Third Party Advisory
http://secunia.com/advisories/27387	Third Party Advisory
http://secunia.com/advisories/27403	Third Party Advisory
http://secunia.com/advisories/27414	Third Party Advisory
http://secunia.com/advisories/27425	Third Party Advisory
http://secunia.com/advisories/27480	Third Party Advisory
http://secunia.com/advisories/27665	Third Party Advisory
http://secunia.com/advisories/27680	Third Party Advisory
http://secunia.com/advisories/28398	Third Party Advisory
http://securitytracker.com/id?1018837	Vdb Entry
http://support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.html	X_refsource_confirm
http://www.securityfocus.com/archive/1/482876/100/200/threaded	Mailing List
http://www.securityfocus.com/archive/1/482925/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/482932/100/200/threaded	Mailing List
http://www.securityfocus.com/bid/26132	Vdb Entry
http://www.vupen.com/english/advisories/2007/3544	Vdb Entry
http://www.vupen.com/english/advisories/2007/3587	Vdb Entry
http://www.vupen.com/english/advisories/2008/0083	Vdb Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=381146	X_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/37287	Vdb Entry
https://issues.rpath.com/browse/RPL-1858	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11443	Signature

URL	Date	SRC

URL	Date	SRC
http://www.mozilla.org/security/announce/2007/mfsa2007-34.html	2018-10-15

URL	Date	SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742	2018-10-15
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1	2018-10-15
http://www.debian.org/security/2007/dsa-1392	2018-10-15
http://www.debian.org/security/2007/dsa-1396	2018-10-15
http://www.debian.org/security/2007/dsa-1401	2018-10-15
http://www.gentoo.org/security/en/glsa/glsa-200711-14.xml	2018-10-15
http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:202	2018-10-15
http://www.novell.com/linux/security/advisories/2007_57_mozilla.html	2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-0979.html	2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-0980.html	2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-0981.html	2018-10-15
http://www.ubuntu.com/usn/usn-536-1	2018-10-15
https://usn.ubuntu.com/535-1	2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.html	2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.html	2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.html	2018-10-15
https://access.redhat.com/security/cve/CVE-2007-5337	2007-10-19
https://bugzilla.redhat.com/show_bug.cgi?id=1618325	2007-10-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnome Search vendor "Gnome"	Gnome-vfs Search vendor "Gnome" for product "Gnome-vfs"	*	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	*	-	Safe
Mozilla Search vendor "Mozilla"	Firefox Search vendor "Mozilla" for product "Firefox"	<= 2.0.0.7 Search vendor "Mozilla" for product "Firefox" and version " <= 2.0.0.7"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	*	-	Safe
Mozilla Search vendor "Mozilla"	Seamonkey Search vendor "Mozilla" for product "Seamonkey"	<= 1.1.4 Search vendor "Mozilla" for product "Seamonkey" and version " <= 1.1.4"	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	*	-	Safe