Vulnerability CVE-2007-1114 - CERT Civis.Net

Vulnerability Name:

CVE-2007-1114 (CCN-32722)

Assigned:

2007-02-23

Published:

2007-02-23

Updated:

2018-10-16

Summary:

The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.

CVSS v3 Severity:

4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2007-0996

Source: MITRE
Type: CNA
CVE-2007-1114

Source: MITRE
Type: CNA
CVE-2007-1115

Source: CCN
Type: RHSA-2007-0077
Critical: seamonkey security update

Source: CCN
Type: RHSA-2007-0078
Critical: thunderbird security update

Source: CCN
Type: RHSA-2007-0079
Critical: Firefox security update

Source: CCN
Type: RHSA-2007-0097
Critical: firefox security update

Source: CCN
Type: RHSA-2007-0108
Critical: thunderbird security update

Source: CCN
Type: SA24205
Mozilla Firefox Multiple Vulnerabilities

Source: CCN
Type: SA24312
Opera Charset Inheritance Cross-Site Scripting Vulnerability

Source: CCN
Type: SA24314
Internet Explorer Charset Inheritance Cross-Site Scripting Vulnerability

Source: SECUNIA
Type: UNKNOWN
24314

Source: CCN
Type: SECTRACK ID: 1017702
Mozilla Firefox Flaws Permit Cross-Site Scripting Attacks and Local File Access

Source: CCN
Type: SECTRACK ID: 1017909
Opera IFRAME Character Encoding Inheritence Permits Cross-Site Scripting Attacks

Source: CCN
Type: ASA-2007-092
SeaMonkey security update (RHSA-2007-0077)

Source: CCN
Type: ASA-2007-095
thunderbird security update (RHSA-2007-0078)

Source: CCN
Type: ASA-2007-114
Firefox security update (RHSA-2007-0079)

Source: DEBIAN
Type: DSA-1336
mozilla-firefox -- several vulnerabilities

Source: CCN
Type: Hardened-PHP Project Advisory 03/2007
Multiple Browsers Cross Domain Charset Inheritance Vulnerability

Source: MISC
Type: Vendor Advisory
http://www.hardened-php.net/advisory_032007.142.html

Source: CCN
Type: MFSA 2007-02
Improvements to help protect against Cross-Site Scripting attacks

Source: OSVDB
Type: UNKNOWN
32119

Source: CCN
Type: OSVDB ID: 32118
Opera Cross Domain Charset Inheritance Weakness

Source: CCN
Type: OSVDB ID: 32119
Microsoft IE Cross Domain Charset Inheritance Weakness

Source: CCN
Type: OSVDB ID: 33812
Mozilla Multiple Products Child Frame Inheritance XSS

Source: BUGTRAQ
Type: UNKNOWN
20070223 Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability

Source: CCN
Type: BID-22694
Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities

Source: BID
Type: UNKNOWN
22701

Source: CCN
Type: BID-22701
Multiple Web Browser UTF-7 Cross-Domain Character-Set-Inheritance Vulnerability

Source: CCN
Type: USN-428-1
Firefox vulnerabilities

Source: CCN
Type: USN-428-2
Firefox regression

Source: VUPEN
Type: UNKNOWN
ADV-2007-0744

Source: XF
Type: UNKNOWN
multiple-browser-charset-xss(32722)

Source: SUSE
Type: SUSE-SA:2007:019
MozillaFirefox security update 1.5.0.10/2.0.0.2

Source: SUSE
Type: SUSE-SA:2007:022
Mozilla security problems

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:ie:7.0:*:vista:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0::dev:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:beta1:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:rc2:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:2.0:rc3:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0::alpha:*:*:*:*:*

OR cpe:/a:mozilla:seamonkey:1.0::beta:*:*:*:*:*

OR cpe:/a:opera:opera_browser:9.0:*:*:*:*:*:*:*

AND

cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*

OR cpe:/a:suse:suse_linux_school_server:-:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*

OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*

OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*

OR cpe:/o:suse:suse_linux:10.1::personal:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*

OR cpe:/a:novell:open_enterprise_server:*:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.2:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

Denotes that component is vulnerable