HTTP: Mozilla Multiple Products Duplicate Location Headers Vulnerability

This signature detects attempts to exploit a known vulnerability in multiple Mozilla products. A vulnerability has been detected in Mozilla Firefox, Thunderbird and SeaMonkey. When multiple Location, Content-Type, Content-Length or Content-Disposition headers are present in an HTTP response, these Mozilla products use the last one, making them more susceptible to newline insertion attacks. An attacker may leverage this vulnerability in conjunction with a vulnerable web application to e.g. redirect target users to malicious URLs.

Extended Description

Mozilla Firefox, SeaMonkey, and Thunderbird are prone to a remote HTTP response-splitting vulnerability. Attackers can leverage this issue to influence or misrepresent how Web content is served, cached, or interpreted. This could aid in various attacks that try to instill client users with a false sense of trust. This issue is fixed in: Firefox 7.0 Firefox 3.6.23 Thunderbird 7.0 SeaMonkey 2.4

Affected Products

Avaya messaging_storage_server

References

BugTraq: 49849

CVE: CVE-2011-3000

Short Name

HTTP:STC:MOZILLA:DUP-LOC-HEADER

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Mozilla Multiple Products Duplicate Location Headers Vulnerability

Extended Description

Affected Products

References

Found a potential security threat?