Bug 730425 (CVE-2008-7293)

Summary:	CVE-2008-7293 firefox: unable to restrict modifications to cookies in HTTPS sessions due to loack of HSTS support
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gecko-bugs-nobody
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-11 09:57:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vincent Danen 2011-08-12 21:16:30 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7293 to
the following vulnerability:

Name: CVE-2008-7293
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7293
Assigned: 20110809
Reference: http://code.google.com/p/browsersec/wiki/Part2 #Same-origin_policy_for_cookies
Reference: http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.html
Reference: http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html
Reference: http://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.html
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=660053
Reference: http://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-force-https/

Mozilla Firefox before 4 cannot properly restrict modifications to
cookies established in HTTPS sessions, which allows man-in-the-middle
attackers to overwrite or delete arbitrary cookies via a Set-Cookie
header in an HTTP response, related to lack of the HTTP Strict
Transport Security (HSTS) includeSubDomains feature, aka a "cookie
forcing" issue.

Comment 1 Vincent Danen 2011-08-12 21:17:44 UTC

The only way I know of to correct this is to upgrade to Firefox 4 or newer.

Comment 3 Huzaifa S. Sidhpurwala 2013-02-11 09:57:55 UTC

Statement:

This issue was addressed in Red Hat Enterprise Linux 5 and 6 by rebasing Firefox to 10.0.0 ESR.