Bug 486704 – CVE-2009-0652 firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 486704 - (CVE-2009-0652) CVE-2009-0652 firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)

Summary:	CVE-2009-0652 firefox: does not properly prevent the literal rendering of hom...

Status:	VERIFIED

Aliases:	CVE-2009-0652

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:	https://www.blackhat.com/presentation...
Whiteboard:	public=20090216,reported=20090220,imp...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2009-02-21 05:16 EST by Jan Lieskovsky
Modified:	2018-10-31 18:44 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2009:0436	normal	SHIPPED_LIVE	Critical: firefox security update	2009-04-21 21:42:27 EDT
Red Hat Product Errata	RHSA-2009:0437	normal	SHIPPED_LIVE	Critical: seamonkey security update	2009-04-21 19:59:24 EDT

Groups: None (edit)

Description Jan Lieskovsky 2009-02-21 05:16:01 EST

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0652 to
the following vulnerability:

Mozilla Firefox 3.0.6 does not properly prevent the literal rendering
of homoglyph characters in IDN domain names, which allows remote
attackers to spoof URLs and conduct phishing attacks, as demonstrated
by homoglyphs of the / (slash) and ? (question mark) characters in a
subdomain of a .cn domain name, a different vulnerability than
CVE-2005-0233.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0652
http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike
https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf
http://www.securityfocus.com/bid/33837

Comment 2 errata-xmlrpc 2009-04-21 19:59:49 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 3
  Red Hat Enterprise Linux 2.1

Via RHSA-2009:0437 https://rhn.redhat.com/errata/RHSA-2009-0437.html

Comment 3 errata-xmlrpc 2009-04-21 21:43:10 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:0436 https://rhn.redhat.com/errata/RHSA-2009-0436.html

Comment 4 Fedora Update System 2009-04-22 16:25:00 EDT

xulrunner-1.9.0.9-1.fc9, firefox-3.0.9-1.fc9, epiphany-extensions-2.22.1-10.fc9, epiphany-2.22.2-10.fc9, blam-1.8.5-8.fc9.1, chmsee-1.0.1-11.fc9, devhelp-0.19.1-11.fc9, evolution-rss-0.1.0-10.fc9, galeon-2.0.7-9.fc9, gnome-python2-extras-2.19.1-26.fc9, gnome-web-photo-0.3-20.fc9, google-gadgets-0.10.5-5.fc9, gtkmozembedmm-1.4.2.cvs20060817-28.fc9, kazehakase-0.5.6-4.fc9.1, Miro-2.0.3-3.fc9, mozvoikko-0.9.5-9.fc9, mugshot-1.2.2-8.fc9, ruby-gnome2-0.17.0-8.fc9, totem-2.23.2-14.fc9, yelp-2.22.1-11.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2009-04-24 15:50:22 EDT

xulrunner-1.9.0.9-1.fc10, firefox-3.0.9-1.fc10, epiphany-extensions-2.24.0-7.fc10, epiphany-2.24.3-5.fc10, blam-1.8.5-9.fc10, devhelp-0.22-7.fc10, galeon-2.0.7-9.fc10, gecko-sharp2-0.13-7.fc10, gnome-python2-extras-2.19.1-29.fc10, gnome-web-photo-0.3-17.fc10, google-gadgets-0.10.5-5.fc10, kazehakase-0.5.6-4.fc10.1, Miro-2.0.3-3.fc10, mozvoikko-0.9.5-9.fc10, mugshot-1.2.2-8.fc10, pcmanx-gtk2-0.3.8-8.fc10, perl-Gtk2-MozEmbed-0.08-5.fc10.2, ruby-gnome2-0.18.1-5.fc10.1, yelp-2.24.0-8.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.