Vulnerability Description
The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | >= 1.5, < 1.5.0.11 |
| Canonical | Ubuntu Linux | 5.10 |
Related Weaknesses (CWE)
References
- http://bindshell.net/papers/ftppasv/ftp-client-pasv-manipulation.pdfBroken Link
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Broken Link
- http://secunia.com/advisories/25476Third Party Advisory
- http://secunia.com/advisories/25490Third Party Advisory
- http://secunia.com/advisories/25858Third Party Advisory
- http://www.mozilla.org/security/announce/2007/mfsa2007-11.htmlVendor Advisory
- http://www.novell.com/linux/security/advisories/2007_36_mozilla.htmlBroken Link
- http://www.openwall.com/lists/oss-security/2020/12/09/1
- http://www.redhat.com/support/errata/RHSA-2007-0400.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2007-0402.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/463501/100/0/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/470172/100/200/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/23082Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1017800Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/usn-443-1Third Party Advisory
FAQ
What is CVE-2007-1562?
CVE-2007-1562 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtai...
How severe is CVE-2007-1562?
CVE-2007-1562 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-1562?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Canonical Ubuntu Linux.