Bug 785464 (CVE-2011-3670)

Summary:	CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-like hostname syntax (MFSA 2012-02)
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	caillon, gecko-bugs-nobody, security-response-team, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-01 09:04:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Huzaifa S. Sidhpurwala 2012-01-29 02:12:25 UTC

In Firefox, it is possible to make requests using IPv6 syntax (http://[example.com]/) via XMLHttpRequest objects.  If an HTTP proxy has been configured, the request will be handled by the proxy. Depending on proxy implementations some errors may occur. Error messages from HTTP proxies often include sensitive network diagnostic information such as client IP addresses, internal hostnames, email addresses and possibly a copy of the HTTP request.
Because http://example.com/ and http://[example.com]/ are same origin, the XMLHttpRequest object can be used to read this information from the response.
A remote site may be able to construct such requests in order to reduce a user's privacy.  Additionally, if a copy of the HTTP request is included in the error response, it may be possible to read cookies marked as HttpOnly in XSS situations.

Reference:
https://bugzilla.mozilla.org/show_bug.cgi?id=504014

Comment 1 Tomas Hoger 2012-01-31 19:53:13 UTC

Public now via:
  http://www.mozilla.org/security/announce/2012/mfsa2012-02.html

Comment 2 Vincent Danen 2012-01-31 20:21:43 UTC

External References:

http://www.mozilla.org/security/announce/2012/mfsa2012-02.html

Comment 3 errata-xmlrpc 2012-01-31 23:44:56 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0080 https://rhn.redhat.com/errata/RHSA-2012-0080.html

Comment 4 errata-xmlrpc 2012-02-01 00:07:19 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2012:0079 https://rhn.redhat.com/errata/RHSA-2012-0079.html

Comment 5 errata-xmlrpc 2012-02-01 08:25:05 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2012:0085 https://rhn.redhat.com/errata/RHSA-2012-0085.html

Comment 6 errata-xmlrpc 2012-02-01 08:25:17 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2012:0084 https://rhn.redhat.com/errata/RHSA-2012-0084.html