Vulnerability Name:

CVE-2005-0593 (CCN-19536)

Assigned:2005-02-24
Published:2005-02-24
Updated:2017-10-11
Summary:Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2005-0593

Source: CCN
Type: RHSA-2005-176
firefox security update

Source: CCN
Type: RHSA-2005-384
Mozilla security update

Source: CCN
Type: CIAC INFORMATION BULLETIN P-149
Firefox Security Update

Source: CCN
Type: GLSA-200503-10
Mozilla Firefox: Various vulnerabilities

Source: GENTOO
Type: Patch, Vendor Advisory
GLSA-200503-10

Source: CCN
Type: GLSA-200503-30
Mozilla Suite: Multiple vulnerabilities

Source: GENTOO
Type: Vendor Advisory
GLSA-200503-30

Source: CCN
Type: Mozilla Firefox Download Web page
Download Firefox

Source: CCN
Type: Mozilla Suite Download Web page
Mozilla Suite

Source: CCN
Type: MFSA 2005-14
SSL "secure site" indicator spoofing

Source: CONFIRM
Type: UNKNOWN
http://www.mozilla.org/security/announce/mfsa2005-14.html

Source: REDHAT
Type: UNKNOWN
RHSA-2005:176

Source: REDHAT
Type: UNKNOWN
RHSA-2005:384

Source: BID
Type: UNKNOWN
12659

Source: CCN
Type: BID-12659
Mozilla Suite Multiple Remote Vulnerabilities

Source: CCN
Type: USN-149-3
Ubuntu 4.10 update for Firefox vulnerabilities

Source: CONFIRM
Type: Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=258048

Source: CONFIRM
Type: Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=268483

Source: CONFIRM
Type: Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=276720

Source: CONFIRM
Type: Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=277564

Source: XF
Type: UNKNOWN
mozilla-ssl-indicator-spoofing(19536)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100044

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9533

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • OR cpe:/a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:9533
    V
    		Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.
    2013-04-29
    oval:org.mitre.oval:def:100044
    V
    		Mozilla SSL Lock Image Spoofing Vulnerability
    2007-05-09
    oval:com.redhat.rhsa:def:20050384
    P
    		RHSA-2005:384: Mozilla security update (Important)
    2005-04-28
    oval:com.redhat.rhsa:def:20050176
    P
    		RHSA-2005:176: firefox security update (Critical)
    2005-03-01
    BACK
    mozilla firefox 0.8
    mozilla firefox 0.9
    mozilla firefox 0.9 rc
    mozilla firefox 0.9.1
    mozilla firefox 0.9.2
    mozilla firefox 0.9.3
    mozilla firefox 0.10
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla mozilla 1.3
    mozilla mozilla 1.4
    mozilla mozilla 1.4 alpha
    mozilla mozilla 1.4.1
    mozilla mozilla 1.5
    mozilla mozilla 1.5 alpha
    mozilla mozilla 1.5 rc1
    mozilla mozilla 1.5 rc2
    mozilla mozilla 1.5.1
    mozilla mozilla 1.6
    mozilla mozilla 1.6 alpha
    mozilla mozilla 1.6 beta
    mozilla mozilla 1.7
    mozilla mozilla 1.7 alpha
    mozilla mozilla 1.7 beta
    mozilla mozilla 1.7 rc1
    mozilla mozilla 1.7 rc2
    mozilla mozilla 1.7 rc3
    mozilla mozilla 1.7.1
    mozilla mozilla 1.7.2
    mozilla mozilla 1.7.3
    mozilla mozilla 1.7.5
    mozilla mozilla 1.3
    mozilla mozilla 1.4
    mozilla mozilla 1.6
    mozilla mozilla 1.7 rc3
    mozilla firefox 0.8
    mozilla firefox 0.9 rc
    mozilla mozilla 1.7
    mozilla mozilla 1.7.1
    mozilla firefox 0.9.2
    mozilla firefox 0.9.1
    mozilla firefox 0.9.3
    mozilla mozilla 1.7.2
    mozilla mozilla 1.7.3
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla mozilla 1.7.5
    mozilla firefox 0.10
    mozilla firefox 0.9
    mozilla mozilla 1.4.1
    mozilla mozilla 1.4 alpha
    mozilla mozilla 1.5
    mozilla mozilla 1.5.1
    mozilla mozilla 1.5 alpha
    mozilla mozilla 1.5 rc1
    mozilla mozilla 1.5 rc2
    mozilla mozilla 1.6 alpha
    mozilla mozilla 1.6 beta
    mozilla mozilla 1.7.4
    mozilla mozilla 1.7 alpha
    mozilla mozilla 1.7 beta
    mozilla mozilla 1.7 rc1
    mozilla mozilla 1.7 rc2
    gentoo linux *
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat linux advanced workstation 2.1