CVE-2007-4879

Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automatically install TLS client certificates with minimal user interaction, and automatically sends these certificates when requested, which makes it easier for remote web sites to track user activities across domains by requesting the TLS client certificates from other domains.
References
Link Resource
http://0x90.eu/ff_tls_poc.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
http://secunia.com/advisories/29526 Vendor Advisory
http://secunia.com/advisories/29539 Vendor Advisory
http://secunia.com/advisories/29541 Vendor Advisory
http://secunia.com/advisories/29547 Vendor Advisory
http://secunia.com/advisories/29558 Vendor Advisory
http://secunia.com/advisories/29560 Vendor Advisory
http://secunia.com/advisories/29616 Vendor Advisory
http://secunia.com/advisories/29645 Vendor Advisory
http://secunia.com/advisories/30327 Vendor Advisory
http://secunia.com/advisories/30620 Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
http://www.debian.org/security/2008/dsa-1532
http://www.debian.org/security/2008/dsa-1534
http://www.debian.org/security/2008/dsa-1535
http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:080
http://www.mozilla.org/security/announce/2008/mfsa2008-17.html
http://www.securityfocus.com/archive/1/490196/100/0/threaded
http://www.securityfocus.com/bid/28448
http://www.securitytracker.com/id?1019704
http://www.ubuntu.com/usn/usn-592-1
http://www.us-cert.gov/cas/techalerts/TA08-087A.html US Government Resource
http://www.vupen.com/english/advisories/2008/0998/references Vendor Advisory
http://www.vupen.com/english/advisories/2008/1793/references Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=395399
http://0x90.eu/ff_tls_poc.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html
http://secunia.com/advisories/29526 Vendor Advisory
http://secunia.com/advisories/29539 Vendor Advisory
http://secunia.com/advisories/29541 Vendor Advisory
http://secunia.com/advisories/29547 Vendor Advisory
http://secunia.com/advisories/29558 Vendor Advisory
http://secunia.com/advisories/29560 Vendor Advisory
http://secunia.com/advisories/29616 Vendor Advisory
http://secunia.com/advisories/29645 Vendor Advisory
http://secunia.com/advisories/30327 Vendor Advisory
http://secunia.com/advisories/30620 Vendor Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128
http://www.debian.org/security/2008/dsa-1532
http://www.debian.org/security/2008/dsa-1534
http://www.debian.org/security/2008/dsa-1535
http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:080
http://www.mozilla.org/security/announce/2008/mfsa2008-17.html
http://www.securityfocus.com/archive/1/490196/100/0/threaded
http://www.securityfocus.com/bid/28448
http://www.securitytracker.com/id?1019704
http://www.ubuntu.com/usn/usn-592-1
http://www.us-cert.gov/cas/techalerts/TA08-087A.html US Government Resource
http://www.vupen.com/english/advisories/2008/0998/references Vendor Advisory
http://www.vupen.com/english/advisories/2008/1793/references Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=395399
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9:rc:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.9.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:0.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0:preview_release:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5:beta1:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5:beta2:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.0.12:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.5.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:1.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:2.0.0.11:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0:alpha:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0:beta:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1:alpha:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1:beta:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:1.1.7:*:*:*:*:*:*:*

History

21 Nov 2024, 00:36

Type Values Removed Values Added
References () http://0x90.eu/ff_tls_poc.html - () http://0x90.eu/ff_tls_poc.html -
References () http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html - () http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html -
References () http://secunia.com/advisories/29526 - Vendor Advisory () http://secunia.com/advisories/29526 - Vendor Advisory
References () http://secunia.com/advisories/29539 - Vendor Advisory () http://secunia.com/advisories/29539 - Vendor Advisory
References () http://secunia.com/advisories/29541 - Vendor Advisory () http://secunia.com/advisories/29541 - Vendor Advisory
References () http://secunia.com/advisories/29547 - Vendor Advisory () http://secunia.com/advisories/29547 - Vendor Advisory
References () http://secunia.com/advisories/29558 - Vendor Advisory () http://secunia.com/advisories/29558 - Vendor Advisory
References () http://secunia.com/advisories/29560 - Vendor Advisory () http://secunia.com/advisories/29560 - Vendor Advisory
References () http://secunia.com/advisories/29616 - Vendor Advisory () http://secunia.com/advisories/29616 - Vendor Advisory
References () http://secunia.com/advisories/29645 - Vendor Advisory () http://secunia.com/advisories/29645 - Vendor Advisory
References () http://secunia.com/advisories/30327 - Vendor Advisory () http://secunia.com/advisories/30327 - Vendor Advisory
References () http://secunia.com/advisories/30620 - Vendor Advisory () http://secunia.com/advisories/30620 - Vendor Advisory
References () http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1 - () http://sunsolve.sun.com/search/document.do?assetkey=1-26-238492-1 -
References () http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128 - () http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0128 -
References () http://www.debian.org/security/2008/dsa-1532 - () http://www.debian.org/security/2008/dsa-1532 -
References () http://www.debian.org/security/2008/dsa-1534 - () http://www.debian.org/security/2008/dsa-1534 -
References () http://www.debian.org/security/2008/dsa-1535 - () http://www.debian.org/security/2008/dsa-1535 -
References () http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml - () http://www.gentoo.org/security/en/glsa/glsa-200805-18.xml -
References () http://www.mandriva.com/security/advisories?name=MDVSA-2008:080 - () http://www.mandriva.com/security/advisories?name=MDVSA-2008:080 -
References () http://www.mozilla.org/security/announce/2008/mfsa2008-17.html - () http://www.mozilla.org/security/announce/2008/mfsa2008-17.html -
References () http://www.securityfocus.com/archive/1/490196/100/0/threaded - () http://www.securityfocus.com/archive/1/490196/100/0/threaded -
References () http://www.securityfocus.com/bid/28448 - () http://www.securityfocus.com/bid/28448 -
References () http://www.securitytracker.com/id?1019704 - () http://www.securitytracker.com/id?1019704 -
References () http://www.ubuntu.com/usn/usn-592-1 - () http://www.ubuntu.com/usn/usn-592-1 -
References () http://www.us-cert.gov/cas/techalerts/TA08-087A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA08-087A.html - US Government Resource
References () http://www.vupen.com/english/advisories/2008/0998/references - Vendor Advisory () http://www.vupen.com/english/advisories/2008/0998/references - Vendor Advisory
References () http://www.vupen.com/english/advisories/2008/1793/references - Vendor Advisory () http://www.vupen.com/english/advisories/2008/1793/references - Vendor Advisory
References () https://bugzilla.mozilla.org/show_bug.cgi?id=395399 - () https://bugzilla.mozilla.org/show_bug.cgi?id=395399 -

Information

Published : 2007-09-13 18:17

Updated : 2024-11-21 00:36


NVD link : CVE-2007-4879

Mitre link : CVE-2007-4879

CVE.ORG link : CVE-2007-4879


JSON object : View

Products Affected

mozilla

  • firefox
  • seamonkey