1. CVE-Search
  2. CVE-2005-0149
ID CVE-2005-0149
Summary Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers to bypass the user's intended privacy and security policy by using cookies in e-mail messages.
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:alpha:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:beta:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc1:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc2:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7:rc3:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:mozilla:1.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:0.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:0.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:0.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:thunderbird:0.9:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-10-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
oval via4
  • accepted 2007-05-09T16:10:46.289-04:00
    class vulnerability
    contributors
    • name Robert L. Hollis
      organization ThreatGuard, Inc.
    • name Matthew Wojcik
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    • name Jonathan Baker
      organization The MITRE Corporation
    description Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers bypass the user's intended privacy and security policy by using cookies in e-mail messages.
    family windows
    id oval:org.mitre.oval:def:100047
    status accepted
    submitted 2005-08-16T12:00:00.000-04:00
    title Mozilla Mail News Cookie Security Bypass Vulnerability
    version 6
  • accepted 2013-04-29T04:13:51.247-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers bypass the user's intended privacy and security policy by using cookies in e-mail messages.
    family unix
    id oval:org.mitre.oval:def:11407
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Thunderbird 0.6 through 0.9 and Mozilla 1.7 through 1.7.3 does not obey the network.cookie.disableCookieForMailNews preference, which could allow remote attackers bypass the user's intended privacy and security policy by using cookies in e-mail messages.
    version 29
redhat via4
advisories
  • rhsa
    id RHSA-2005:094
  • rhsa
    id RHSA-2005:323
  • rhsa
    id RHSA-2005:335
rpms
  • thunderbird-0:1.0-1.1.EL4
  • thunderbird-debuginfo-0:1.0-1.1.EL4
  • devhelp-0:0.9.2-2.4.3
  • devhelp-debuginfo-0:0.9.2-2.4.3
  • devhelp-devel-0:0.9.2-2.4.3
  • evolution-0:2.0.2-14
  • evolution-debuginfo-0:2.0.2-14
  • evolution-devel-0:2.0.2-14
refmap via4
bid 12407
confirm
secunia 19823
suse SUSE-SA:2006:022
xf mozilla-cookie-policy-bypass(19172)
Last major update 11-10-2017 - 01:29
Published 15-02-2005 - 05:00
Last modified 11-10-2017 - 01:29
Back to Top