HTTP: Firefox WYCIWYG URI Cache Zone Bypass

This signature detects attempts to exploit a known vulnerability in Mozilla FireFox. An attacker can create a malicious Web page containing dangerous URI's, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Mozilla Firefox is prone to a cache-zone-bypass vulnerability because the application fails to properly block remote access to special internally generated URIs containing cached data. Exploiting this issue allows remote attackers to access potentially sensitive information and to place markers with similar functionality to cookies onto targeted users' computers, regardless of cookie security settings. Information harvested in successful exploits may aid in further attacks. Attackers may also potentially exploit this issue to perform cache-poisoning or URL-spoofing attacks. This issue is being tracked by Mozilla's Bugzilla Bug 387333.

Affected Products

Mozilla firefox

References

BugTraq: 24831

CVE: CVE-2007-3656

URL: https://bugzilla.mozilla.org/show_bug.cgi?id=387333 http://lcamtuf.coredump.cx/ffcache/

Short Name

HTTP:STC:MOZILLA:FF-WYCIWYG

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Firefox WYCIWYG URI Cache Zone Bypass

Extended Description

Affected Products

References

Found a potential security threat?