Bug 785464 (CVE-2011-3670) - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-like hostname syntax (MFSA 2012-02)
Summary: CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-like hostname syntax (MF...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-3670
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-01-29 02:12 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-24 13:15 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-01 09:04:08 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0079 0 normal SHIPPED_LIVE Critical: firefox security update 2012-02-01 05:04:08 UTC
Red Hat Product Errata RHSA-2012:0080 0 normal SHIPPED_LIVE Critical: thunderbird security update 2012-02-01 04:43:33 UTC
Red Hat Product Errata RHSA-2012:0084 0 normal SHIPPED_LIVE Critical: seamonkey security update 2012-02-01 13:22:13 UTC
Red Hat Product Errata RHSA-2012:0085 0 normal SHIPPED_LIVE Critical: thunderbird security update 2012-02-01 13:20:25 UTC

Description Huzaifa S. Sidhpurwala 2012-01-29 02:12:25 UTC 
In Firefox, it is possible to make requests using IPv6 syntax (http://[example.com]/) via XMLHttpRequest objects.  If an HTTP proxy has been configured, the request will be handled by the proxy. Depending on proxy implementations some errors may occur. Error messages from HTTP proxies often include sensitive network diagnostic information such as client IP addresses, internal hostnames, email addresses and possibly a copy of the HTTP request.
Because http://example.com/ and http://[example.com]/ are same origin, the XMLHttpRequest object can be used to read this information from the response.
A remote site may be able to construct such requests in order to reduce a user's privacy.  Additionally, if a copy of the HTTP request is included in the error response, it may be possible to read cookies marked as HttpOnly in XSS situations.

Reference:
https://bugzilla.mozilla.org/show_bug.cgi?id=504014
Comment 1 Tomas Hoger 2012-01-31 19:53:13 UTC 
Public now via:
  http://www.mozilla.org/security/announce/2012/mfsa2012-02.html
Comment 2 Vincent Danen 2012-01-31 20:21:43 UTC 
External References:

http://www.mozilla.org/security/announce/2012/mfsa2012-02.html
Comment 3 errata-xmlrpc 2012-01-31 23:44:56 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0080 https://rhn.redhat.com/errata/RHSA-2012-0080.html
Comment 4 errata-xmlrpc 2012-02-01 00:07:19 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2012:0079 https://rhn.redhat.com/errata/RHSA-2012-0079.html
Comment 5 errata-xmlrpc 2012-02-01 08:25:05 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2012:0085 https://rhn.redhat.com/errata/RHSA-2012-0085.html
Comment 6 errata-xmlrpc 2012-02-01 08:25:17 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2012:0084 https://rhn.redhat.com/errata/RHSA-2012-0084.html
Note You need to log in before you can comment on or make changes to this bug.