CVE-2005-0590

Published: May 2, 2005Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.

Affected (44)

Products: Mozilla: Firefox, Mozilla, Thunderbird

3 products

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 1.0
Mozilla Mozilla	Version 1.3
Mozilla Mozilla	Version 1.4.1
Mozilla Mozilla	Version 1.4
Mozilla Mozilla	Version 1.4 alpha
Mozilla Mozilla	Version 1.5.1
Mozilla Mozilla	Version 1.5
Mozilla Mozilla	Version 1.5 alpha
Mozilla Mozilla	Version 1.5 rc1
Mozilla Mozilla	Version 1.5 rc2
Mozilla Mozilla	Version 1.6
Mozilla Mozilla	Version 1.6 alpha
Mozilla Mozilla	Version 1.6 beta
Mozilla Mozilla	Version 1.7.1
Mozilla Mozilla	Version 1.7.2
Mozilla Mozilla	Version 1.7.3
Mozilla Mozilla	Version 1.7.5
Mozilla Mozilla	Version 1.7
Mozilla Mozilla	Version 1.7 alpha
Mozilla Mozilla	Version 1.7 beta
Mozilla Mozilla	Version 1.7 rc1
Mozilla Mozilla	Version 1.7 rc2
Mozilla Mozilla	Version 1.7 rc3
Mozilla Thunderbird	Version 0.1
Mozilla Thunderbird	Version 0.2
Mozilla Thunderbird	Version 0.3
Mozilla Thunderbird	Version 0.4
Mozilla Thunderbird	Version 0.5
Mozilla Thunderbird	Version 0.6
Mozilla Thunderbird	Version 0.7.1
Mozilla Thunderbird	Version 0.7.2
Mozilla Thunderbird	Version 0.7.3
Mozilla Thunderbird	Version 0.7
Mozilla Thunderbird	Version 0.8
Mozilla Thunderbird	Version 0.9
Mozilla Thunderbird	Version 1.0

References (22)

http://secunia.com/advisories/19823

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml

Source: secalert@redhat.com

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml

Source: secalert@redhat.com

PatchVendor Advisory

http://www.mozilla.org/security/announce/mfsa2005-17.html

Source: secalert@redhat.com

Vendor Advisory

http://www.novell.com/linux/security/advisories/2006_04_25.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2005-176.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2005-384.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/12659

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=268059

Source: secalert@redhat.com

Patch

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100041

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10010

Source: secalert@redhat.com

http://secunia.com/advisories/19823

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.gentoo.org/security/en/glsa/glsa-200503-10.xml

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200503-30.xml

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.mozilla.org/security/announce/mfsa2005-17.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.novell.com/linux/security/advisories/2006_04_25.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2005-176.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2005-384.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/12659

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=268059

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100041

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10010

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.