Vulnerability CVE-2005-2266 - CERT Civis.Net

Vulnerability Name:

CVE-2005-2266 (CCN-21332)

Assigned:

2005-07-12

Published:

2005-07-12

Updated:

2017-10-11

Summary:

Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: SGI Security Advisory 20050802-01-U
SGI Advanced Linux Environment 3 Security Update #45

Source: MITRE
Type: CNA
CVE-2005-2266

Source: CCN
Type: Conectiva Linux Security Announcement CLSA-2005:994
New upstream for mozilla

Source: CCN
Type: RHSA-2005-586
firefox security update

Source: CCN
Type: RHSA-2005-587
mozilla security update

Source: CCN
Type: RHSA-2005-601
thunderbird security update

Source: CCN
Type: SA15549
Firefox Property Manipulation Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: UNKNOWN
15549

Source: CCN
Type: SA15551
Mozilla Property Manipulation Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: UNKNOWN
15551

Source: CCN
Type: SA15553
Netscape Property Manipulation Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: UNKNOWN
15553

Source: CCN
Type: SA15601
Mozilla / Mozilla Firefox Frame Injection Vulnerability

Source: SECUNIA
Type: UNKNOWN
19823

Source: CCN
Type: CIAC INFORMATION BULLETIN P-251
Mozilla Security Updates

Source: CCN
Type: CIAC INFORMATION BULLETIN P-252
Firefox Security Updates

Source: DEBIAN
Type: UNKNOWN
DSA-810

Source: DEBIAN
Type: DSA-775
mozilla-firefox -- frame injection spoofing

Source: DEBIAN
Type: DSA-777
mozilla -- frame injection spoofing

Source: DEBIAN
Type: DSA-779
mozilla-firefox -- several vulnerabilities

Source: DEBIAN
Type: DSA-781
mozilla-thunderbird -- several vulnerabilities

Source: DEBIAN
Type: DSA-810
mozilla -- several vulnerabilities

Source: CCN
Type: GLSA-200507-14
Mozilla Firefox: Multiple vulnerabilities

Source: CCN
Type: Mozilla Firefox Download Web page
Firefox - Rediscover the web

Source: CCN
Type: Mozilla Suite Web page
Mozilla Suite- The All-in-One Internet Application Suite

Source: CCN
Type: MFSA 2005-52
Same origin violation: frame calling top.focus()

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.mozilla.org/security/announce/mfsa2005-52.html

Source: SUSE
Type: UNKNOWN
SUSE-SR:2005:018

Source: SUSE
Type: UNKNOWN
SUSE-SA:2005:045

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:004

Source: REDHAT
Type: UNKNOWN
RHSA-2005:586

Source: REDHAT
Type: UNKNOWN
RHSA-2005:587

Source: REDHAT
Type: UNKNOWN
RHSA-2005:601

Source: BID
Type: UNKNOWN
14242

Source: CCN
Type: BID-14242
Mozilla Suite, Firefox And Thunderbird Multiple Vulnerabilities

Source: CCN
Type: USN-149-1
Firefox vulnerabilities

Source: CCN
Type: USN-149-2
Fixed Firefox packages for USN-149-1

Source: CCN
Type: USN-149-3
Ubuntu 4.10 update for Firefox vulnerabilities

Source: CCN
Type: USN-155-1
Mozilla vulnerabilities

Source: CCN
Type: USN-155-2
Updated Epiphany packages to match Mozilla security update

Source: CCN
Type: USN-155-3
Fixed mozilla locale packages

Source: VUPEN
Type: UNKNOWN
ADV-2005-1075

Source: FEDORA
Type: UNKNOWN
FLSA:160202

Source: XF
Type: UNKNOWN
mozilla-frame-topfocus-xss(21332)

Source: XF
Type: UNKNOWN
mozilla-frame-topfocus-xss(21332)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100107

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10712

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1415

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:773

Source: SUSE
Type: SUSE-SA:2005:045
mozilla MozillaFirefox epiphany galeon: information leak

Source: SUSE
Type: SUSE-SA:2006:022
MozillaThunderbird various problems

Vulnerable Configuration:

Configuration 1:

cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mozilla:mozilla:1.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.8:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9:rc:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.8:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.10:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:0.9:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*

OR cpe:/a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*

AND

cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*

OR cpe:/o:conectiva:linux:10:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*

OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20052266	V	CVE-2005-2266	2015-11-16
oval:org.mitre.oval:def:10712	V	Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.	2013-04-29
oval:org.mitre.oval:def:1415	V	RHE4 Mozilla top.focus() Cross-Site Scripting Vulnerability	2013-04-08
oval:org.debian:def:779	V	several vulnerabilities	2013-01-21
oval:org.mitre.oval:def:100107	V	Firefox and Mozilla top.focus() Cross-Site Scripting Vulnerability	2007-02-20
oval:org.mitre.oval:def:773	V	RHE3 Mozilla top.focus() Cross-Site Scripting Vulnerability	2005-10-12
oval:org.debian:def:810	V	several vulnerabilities	2005-09-13
oval:org.debian:def:781	V	several vulnerabilities	2005-08-23
oval:com.redhat.rhsa:def:20050587	P	RHSA-2005:587: mozilla security update (Important)	2005-07-22
oval:com.redhat.rhsa:def:20050586	P	RHSA-2005:586: firefox security update (Important)	2005-07-21
oval:com.redhat.rhsa:def:20050601	P	RHSA-2005:601: thunderbird security update (Important)	2005-07-21