CVE-2007-0981 Security feature bypass in n/a
Remote attackers can bypass same-origin policy and steal cookies by exploiting null byte handling in the hostname DOM property.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2007-0981?
CVE-2007-0981 is a high-severity vulnerability in Mozilla Firefox, published on 16 Feb 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.
Weakness: CWE-264
Which versions are affected by CVE-2007-0981?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Seamonkey.
How do I fix CVE-2007-0981?
Upgrade to a fixed version.
Is CVE-2007-0981 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-0981 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-j9xc-r2mv-xr3g.