MEDIUM
firefox: URL bar spoofing vulnerability
Published Aug 3, 2009
5.8
MEDIUMCVSS 2.0
EPSS 4.75%
Description
Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attacks, via a crafted web page that calls window.open with an invalid character in the URL, makes document.write calls to the resulting object, and then calls the stop method during the loading of the error page.
Affected products
No data.
OR
- ≤ 3.5.1
- 0.1
- 0.2
- 0.3
- 0.4
- 0.5
- 0.6
- 0.6.1
- 0.7
- 0.7.1
- 0.8
- 0.9
- 0.9
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9_rc
- 0.10
- 0.10.1
- 1.0
- 1.0
- 1.0.1
- 1.0.2
- 1.0.3
- 1.0.4
- 1.0.5
- 1.0.6
- 1.0.7
- 1.0.8
- 1.4.1
- 1.5
- 1.5
- 1.5
- 1.5.0.1
- 1.5.0.2
- 1.5.0.3
- 1.5.0.4
- 1.5.0.5
- 1.5.0.6
- 1.5.0.7
- 1.5.0.8
- 1.5.0.9
- 1.5.0.10
- 1.5.0.11
- 1.5.0.12
- 1.5.1
- 1.5.2
- 1.5.3
- 1.5.4
- 1.5.5
- 1.5.6
- 1.5.7
- 1.5.8
- 1.8
- 2.0
- 2.0
- 2.0
- 2.0
- 2.0
- 2.0.0.1
- 2.0.0.2
- 2.0.0.3
- 2.0.0.4
- 2.0.0.5
- 2.0.0.6
- 2.0.0.7
- 2.0.0.8
- 2.0.0.9
- 2.0.0.10
- 2.0.0.11
- 2.0.0.12
- 2.0.0.13
- 2.0.0.14
- 2.0.0.15
- 2.0.0.16
- 2.0.0.17
- 2.0.0.18
- 2.0.0.19
- 2.0.0.20
- 2.0.0.21
- 2.0_.1
- 2.0_.4
- 2.0_.5
- 2.0_.6
- 2.0_.7
- 2.0_.9
- 2.0_.10
- 2.0_8
- 3.0
- 3.0
- 3.0
- 3.0.1
- 3.0.2
- 3.0.3
- 3.0.4
- 3.0.5
- 3.0.6
- 3.0.7
- 3.0.8
- 3.0.9
- 3.0.10
- 3.0.11
- 3.0.12
- 3.1
- 3.2
- 3.2
- 3.2
- 3.5
No data.
Red Hat Enterprise Linux 3
seamonkey-0:1.0.9-0.45.el3
Fixed · RHSA-2009:1432
Red Hat Enterprise Linux 4
firefox-0:3.0.14-1.el4
Fixed · RHSA-2009:1430
Red Hat Enterprise Linux 4
nspr-0:4.7.5-1.el4_8
Fixed · RHSA-2009:1430
Red Hat Enterprise Linux 4
seamonkey-0:1.0.9-48.el4_8
Fixed · RHSA-2009:1431
Red Hat Enterprise Linux 5
firefox-0:3.0.14-1.el5_4
Fixed · RHSA-2009:1430
Red Hat Enterprise Linux 5
nspr-0:4.7.5-1.el5_4
Fixed · RHSA-2009:1430
Red Hat Enterprise Linux 5
xulrunner-0:1.9.0.14-1.el5_4
Fixed · RHSA-2009:1430
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | seamonkey-0:1.0.9-0.45.el3 | Fixed | RHSA-2009:1432 |
| Red Hat Enterprise Linux 4 | firefox-0:3.0.14-1.el4 | Fixed | RHSA-2009:1430 |
| Red Hat Enterprise Linux 4 | nspr-0:4.7.5-1.el4_8 | Fixed | RHSA-2009:1430 |
| Red Hat Enterprise Linux 4 | seamonkey-0:1.0.9-48.el4_8 | Fixed | RHSA-2009:1431 |
| Red Hat Enterprise Linux 5 | firefox-0:3.0.14-1.el5_4 | Fixed | RHSA-2009:1430 |
| Red Hat Enterprise Linux 5 | nspr-0:4.7.5-1.el5_4 | Fixed | RHSA-2009:1430 |
| Red Hat Enterprise Linux 5 | xulrunner-0:1.9.0.14-1.el5_4 | Fixed | RHSA-2009:1430 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (30)
- http://blog.mozilla.com/security/2009/07/28/url-bar-spoofing-vulnerability/ x_refsource_CONFIRMPatchVendor Advisory
- http://es.geocities.com/jplopezy/firefoxspoofing.html x_refsource_MISC
- http://osvdb.org/56717 vdb-entryx_refsource_OSVDB
- http://secunia.com/advisories/36001 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/36126 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/36141 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/36435 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/36669 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/36670 third-party-advisoryx_refsource_SECUNIA
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1 vendor-advisoryx_refsource_SUNALERT
- http://www.debian.org/security/2009/dsa-1873 vendor-advisoryx_refsource_DEBIAN
- http://www.mozilla.org/security/announce/2009/mfsa2009-44.html x_refsource_CONFIRMPatchVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1430.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2009-1431.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2009-1432.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/505242/30/0/threaded mailing-listx_refsource_BUGTRAQExploit
- http://www.securityfocus.com/archive/1/505265 mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/35803 vdb-entryx_refsource_BIDExploitPatch
- http://www.securitytracker.com/id?1022603 vdb-entryx_refsource_SECTRACK
- http://www.vupen.com/english/advisories/2009/2006 vdb-entryx_refsource_VUPENPatchVendor Advisory
- http://www.vupen.com/english/advisories/2009/2142 vdb-entryx_refsource_VUPENPatchVendor Advisory
- https://access.redhat.com/security/cve/CVE-2009-2654 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=451898 x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=521311 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2009-2654
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9686 vdb-entrysignaturex_refsource_OVAL
- https://usn.ubuntu.com/811-1/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2009-2654
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00198.html vendor-advisoryx_refsource_FEDORA
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00261.html vendor-advisoryx_refsource_FEDORA
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Aug 3, 2009
Updated Aug 7, 2024
Reserved Aug 3, 2009
Link CVE-2009-2654
CISA Vulnrichment
Updated n/a