Bug 730425 (CVE-2008-7293) - CVE-2008-7293 firefox: unable to restrict modifications to cookies in HTTPS sessions due to loack of HSTS support
Summary: CVE-2008-7293 firefox: unable to restrict modifications to cookies in HTTPS s...
Alias: CVE-2008-7293
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2011-08-12 21:16 UTC by Vincent Danen
Modified: 2019-09-29 12:46 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2013-02-11 09:57:55 UTC

Attachments (Terms of Use)

Description Vincent Danen 2011-08-12 21:16:30 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-7293 to
the following vulnerability:

Name: CVE-2008-7293
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7293
Assigned: 20110809
Reference: http://code.google.com/p/browsersec/wiki/Part2 #Same-origin_policy_for_cookies
Reference: http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.html
Reference: http://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.html
Reference: http://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.html
Reference: https://bugzilla.mozilla.org/show_bug.cgi?id=660053
Reference: http://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-force-https/

Mozilla Firefox before 4 cannot properly restrict modifications to
cookies established in HTTPS sessions, which allows man-in-the-middle
attackers to overwrite or delete arbitrary cookies via a Set-Cookie
header in an HTTP response, related to lack of the HTTP Strict
Transport Security (HSTS) includeSubDomains feature, aka a "cookie
forcing" issue.

Comment 1 Vincent Danen 2011-08-12 21:17:44 UTC
The only way I know of to correct this is to upgrade to Firefox 4 or newer.

Comment 3 Huzaifa S. Sidhpurwala 2013-02-11 09:57:55 UTC

This issue was addressed in Red Hat Enterprise Linux 5 and 6 by rebasing Firefox to 10.0.0 ESR.

Note You need to log in before you can comment on or make changes to this bug.