SSL: Mozilla SSLv2 Client

This signature detects attempts to exploit a known vulnerability in the Mozilla Network Security Services SSLv2 Client. A successful attack can lead to a buffer overflow and arbitrary remote code execution within the context of the application.

Extended Description

The Mozilla Foundation has released six security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird. These vulnerabilities allow attackers to: - Execute arbitrary code - Cause denial-of-service conditions - Perform cross-site scripting attacks - Obtain potentially sensitive information - Spoof legitimate content Other attacks may also be possible. UPDATE: Firefox 2.0.0.10 is still vulnerable to the issue outlined in MFSA 2007-02. Pages followed through 'href' links and embedded iframes inherit the character set of parent pages when a user has manually set the browser charset.

Affected Products

Sun java_system_web_server,Mozilla thunderbird

References

BugTraq: 22694

CVE: CVE-2007-0008

URL: http://www.mozilla.org/security/announce/2007/mfsa2007-06.html

Short Name

SSL:MOZ-SSLV2-CL

Severity

Major

Recommended

False

Recommended Action

Drop

SSL: Mozilla SSLv2 Client

Extended Description

Affected Products

References

Found a potential security threat?