1. CVE-Search
  2. CVE-2005-0584
ID CVE-2005-0584
Summary Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.4:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:rc1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5:rc2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.6:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.6:beta:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.5:*:*:*:*:*:*:*
CVSS
Base: 2.6 (as of 11-10-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:H/Au:N/C:N/I:P/A:N
oval via4
  • accepted 2007-05-09T16:10:39.415-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Matthew Wojcik
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    description Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
    family windows
    id oval:org.mitre.oval:def:100034
    status accepted
    submitted 2005-08-16T12:00:00.000-04:00
    title Mozilla HTTP auth Prompt Tab Spoofing
    version 6
  • accepted 2013-04-29T04:12:12.389-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
    family unix
    id oval:org.mitre.oval:def:11191
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Firefox before 1.0.1 and Mozilla before 1.7.6, when displaying the HTTP Authentication dialog, do not change the focus to the tab that generated the prompt, which could facilitate spoofing and phishing attacks.
    version 29
redhat via4
advisories
  • rhsa
    id RHSA-2005:176
  • rhsa
    id RHSA-2005:384
rpms firefox-0:1.0.1-1.4.3
refmap via4
confirm
gentoo
  • GLSA-200503-10
  • GLSA-200503-30
Last major update 11-10-2017 - 01:29
Published 02-05-2005 - 04:00
Last modified 11-10-2017 - 01:29
Back to Top