Vulnerability Name:

CVE-2005-0591 (CCN-18864)

Assigned:2005-01-12
Published:2005-01-12
Updated:2017-10-11
Summary:Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Other
References:Source: CCN
Type: BugTraq Mailing List, Mon Jan 10 2005 - 17:22:09 CST
Firespoofing [Firefox 1.0]

Source: MITRE
Type: CNA
CVE-2004-1380

Source: MITRE
Type: CNA
CVE-2005-0591

Source: BUGTRAQ
Type: UNKNOWN
20050111 Firespoofing [Firefox 1.0]

Source: CCN
Type: RHSA-2005-176
firefox security update

Source: CCN
Type: RHSA-2005-323
mozilla security update

Source: CCN
Type: RHSA-2005-335
mozilla security update

Source: CCN
Type: RHSA-2005-384
Mozilla security update

Source: CCN
Type: SA12712
Mozilla / Mozilla Firefox / Camino Tabbed Browsing Vulnerabilities

Source: CCN
Type: SA13786
Mozilla / Mozilla Firefox Dialog Overlapping Weakness

Source: SECUNIA
Type: UNKNOWN
13786

Source: CCN
Type: CIAC INFORMATION BULLETIN P-149
Firefox Security Update

Source: CCN
Type: CIAC INFORMATION BULLETIN P-168
Mozilla Security Update

Source: CCN
Type: GLSA-200503-10
Mozilla Firefox: Various vulnerabilities

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200503-10

Source: CCN
Type: GLSA-200503-30
Mozilla Suite: Multiple vulnerabilities

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200503-30

Source: MISC
Type: Exploit
http://www.mikx.de/firespoofing/

Source: MISC
Type: Vendor Advisory
http://www.mikx.de/index.php?p=7

Source: CONFIRM
Type: UNKNOWN
http://www.mozilla.org/security/announce/mfsa2005-16.html

Source: REDHAT
Type: UNKNOWN
RHSA-2005:176

Source: REDHAT
Type: UNKNOWN
RHSA-2005:384

Source: BID
Type: UNKNOWN
12234

Source: CCN
Type: BID-12234
Mozilla/Netscape/Firefox Browser Modal Dialog Spoofing Vulnerability

Source: CCN
Type: USN-149-3
Ubuntu 4.10 update for Firefox vulnerabilities

Source: CONFIRM
Type: Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=260560

Source: XF
Type: UNKNOWN
web-browser-modal-spoofing(18864)

Source: XF
Type: UNKNOWN
web-browser-modal-spoofing(18864)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100042

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10039

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:netscape:navigator:7.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:10039
    V
    		Firefox before 1.0.1 allows remote attackers to spoof the (1) security and (2) download modal dialog boxes, which could be used to trick users into executing script or downloading and executing a file, aka "Firespoofing."
    2013-04-29
    oval:org.mitre.oval:def:100042
    V
    		Mozilla Download/Security Dialogs Spoofing Vulnerability
    2007-05-09
    oval:com.redhat.rhsa:def:20050384
    P
    		RHSA-2005:384: Mozilla security update (Important)
    2005-04-28
    oval:com.redhat.rhsa:def:20050176
    P
    		RHSA-2005:176: firefox security update (Critical)
    2005-03-01
    BACK
    mozilla firefox 0.8
    mozilla firefox 0.9
    mozilla firefox 0.9 rc
    mozilla firefox 0.9.1
    mozilla firefox 0.9.2
    mozilla firefox 0.9.3
    mozilla firefox 0.10
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla firefox 1.0
    mozilla mozilla 1.7.5
    netscape navigator 7.1
    gentoo linux *
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    microsoft windows xp sp2
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat linux advanced workstation 2.1