Vulnerability Description
Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it easier for remote HTTP servers to conduct phishing and spoofing attacks.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | <= 2.0.0.11 |
Related Weaknesses (CWE)
References
- http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthenticaThird Party Advisory
- http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspxThird Party Advisory
- http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofinVendor Advisory
- http://www.securityfocus.com/archive/1/485732/100/200/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/485738/100/200/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/27111Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=244273Issue TrackingVendor Advisory
- http://aviv.raffon.net/2008/01/02/YetAnotherDialogSpoofingFirefoxBasicAuthenticaThird Party Advisory
- http://aviv.raffon.net/2008/01/05/FirefoxDialogSpoofingFAQ.aspxThird Party Advisory
- http://blog.mozilla.com/security/2008/01/04/basicauth-dialog-realm-value-spoofinVendor Advisory
- http://www.securityfocus.com/archive/1/485732/100/200/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/485738/100/200/threadedThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/27111Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=244273Issue TrackingVendor Advisory
FAQ
What is CVE-2008-0367?
CVE-2008-0367 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Mozilla Firefox 2.0.0.11, 3.0b2, and possibly earlier versions, when prompting for HTTP Basic Authentication, displays the site requesting the authentication after the Realm text, which might make it ...
How severe is CVE-2008-0367?
CVE-2008-0367 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-0367?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox.