Vulnerability Name:

CVE-2005-2264 (CCN-21408)

Assigned:2005-07-12
Published:2005-07-12
Updated:2017-10-11
Summary:Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the _search target, then injecting script into other pages via a data: URL.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: SGI Security Advisory 20050802-01-U
SGI Advanced Linux Environment 3 Security Update #45

Source: MITRE
Type: CNA
CVE-2005-2264

Source: CCN
Type: RHSA-2005-586
firefox security update

Source: CCN
Type: SA16043
Firefox Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
16043

Source: CCN
Type: CIAC INFORMATION BULLETIN P-251
Mozilla Security Updates

Source: CCN
Type: CIAC INFORMATION BULLETIN P-252
Firefox Security Updates

Source: CIAC
Type: UNKNOWN
P-252

Source: DEBIAN
Type: DSA-779
mozilla-firefox -- several vulnerabilities

Source: CCN
Type: Mozilla Firefox Download Web page
Firefox - Rediscover the web

Source: CCN
Type: MFSA 2005-49
Script injection from Firefox sidebar panel using data:

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.mozilla.org/security/announce/mfsa2005-49.html

Source: SUSE
Type: UNKNOWN
SUSE-SR:2005:018

Source: SUSE
Type: UNKNOWN
SUSE-SA:2005:045

Source: REDHAT
Type: UNKNOWN
RHSA-2005:586

Source: BID
Type: UNKNOWN
14242

Source: CCN
Type: BID-14242
Mozilla Suite, Firefox And Thunderbird Multiple Vulnerabilities

Source: CCN
Type: USN-149-1
Firefox vulnerabilities

Source: CCN
Type: USN-149-2
Fixed Firefox packages for USN-149-1

Source: CCN
Type: USN-149-3
Ubuntu 4.10 update for Firefox vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2005-1075

Source: MISC
Type: Exploit, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=294074

Source: XF
Type: UNKNOWN
firefox-search-sidebar-script-injection(21408)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100009

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9887

Source: SUSE
Type: SUSE-SA:2005:045
mozilla MozillaFirefox epiphany galeon: information leak

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • AND
  • cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:9887
    V
    		Firefox before 1.0.5 allows remote attackers to steal sensitive information by opening a malicious link in the Firefox sidebar using the _search target, then injecting script into other pages via a data: URL.
    2013-04-29
    oval:org.debian:def:779
    V
    		several vulnerabilities
    2013-01-21
    oval:org.mitre.oval:def:100009
    V
    		Firefox Sidebar Script Injection via _search Target
    2007-05-09
    oval:com.redhat.rhsa:def:20050586
    P
    		RHSA-2005:586: firefox security update (Important)
    2005-07-21
    BACK
    mozilla firefox 0.8
    mozilla firefox 0.9
    mozilla firefox 0.9 rc
    mozilla firefox 0.9.1
    mozilla firefox 0.9.2
    mozilla firefox 0.9.3
    mozilla firefox 0.10
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla firefox 1.0.1
    mozilla firefox 1.0.2
    mozilla firefox 1.0.3
    mozilla firefox 1.0.4
    mozilla firefox 0.8
    mozilla firefox 0.9 rc
    mozilla firefox 0.9.2
    mozilla firefox 0.9.1
    mozilla firefox 0.9.3
    mozilla firefox 0.10.1
    mozilla firefox 1.0
    mozilla firefox 1.0.1
    mozilla firefox 1.0.2
    mozilla firefox 1.0.3
    mozilla firefox 1.0.4
    mozilla firefox 0.10
    mozilla firefox 0.9
    suse linux enterprise server 8
    suse suse linux 8.2
    suse suse linux 9.0
    suse suse linux 9.1
    suse suse linux 9.2
    redhat enterprise linux 4
    redhat enterprise linux 4
    novell linux desktop 9
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    suse linux enterprise server 9
    suse suse linux 9.3