Rapid7 Vulnerability & Exploit Database

Mozilla Firefox SSL Lock Spoofing Vulnerability

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

Mozilla Firefox SSL Lock Spoofing Vulnerability

Severity
3
CVSS
(AV:N/AC:H/Au:N/C:N/I:P/A:N)
Published
03/04/2005
Created
07/25/2018
Added
07/28/2005
Modified
08/30/2012

Description

Firefox before 1.0.1 and Mozilla before 1.7.6 allows remote attackers to spoof the SSL "secure site" lock icon via (1) a web site that does not finish loading, which shows the lock of the previous site, (2) a non-HTTP server that uses SSL, which causes the lock to be displayed when the SSL handshake is completed, or (3) a URL that generates an HTTP 204 error, which updates the icon and location information but does not change the display of the original site.

Solution(s)

  • mozilla-firefox-upgrade-1_0_1
  • mozilla-firefox-upgrade-latest

References

View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;