17913 : Multiple Browser Multiple DHTML Property Manipulation XSS
Printer | http://osvdb.org/17913 | Email This | Edit Vulnerability

Views This Week

1

Views All Time

22

Info

Last Modified

about 1 year ago

Percent Complete

40%

Disclosure

Jul 13, 2005

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

This Entry needs help! It is only 40% Complete. Click the edit link above to add more information.

Contributing is fast and easy, and benefits the entire security community.

Description

(Description Provided by CVE) : Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in the same domain as their parents.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
OSVDB: Web Related

Products

Hewlett-Packard Development Company, L.P.

OpenVMS Secure Web Browser

1.7.8

References

Bugtraq ID: 14242
Secunia Advisory ID: 15549 15551 15553 16095 16141 16150 16151 16157 16164 16168 16175 16197 16230 16233 16257 16326 16418 16437 16507 16527 16797 16894 17057 19823
CVE ID: 2005-2266 (see also: NVD)
ISS X-Force ID: 21332
Other Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20050802-01-U.asc http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:128
http://lists.suse.com/archive/suse-security-announce/2005-Jul/0006.html
http://security.gentoo.org/glsa/glsa-200507-14.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware- ......
http://www.debian.org/security/2005/dsa-779
http://www.debian.org/security/2005/dsa-781
http://www.debian.org/security/2005/dsa-810
http://www.gentoo.org/security/en/glsa/glsa-200507-24.xml
http://www.novell.com/linux/security/advisories/2005_45_mozilla.html
http://www.ubuntulinux.org/support/documentation/usn/usn-149-1
http://www.ubuntulinux.org/support/documentation/usn/usn-155-1
Keyword: HPSBOV01229 Mozilla Foundation Security Advisory 2005-52 SSRT5999
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-09/0236.html
Vendor Specific Advisory URL: http://www.mozilla.org/security/announce/mfsa2005-52.html
http://www.novell.com/linux/security/advisories/2006_04_25.html
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01231
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBOV01229
Vendor Specific Solution URL: http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01230
Vendor Specific News/Changelog Entry: https://bugzilla.mozilla.org/show_bug.cgi?id=296830
RedHat RHSA: RHSA-2005:586 RHSA-2005:587 RHSA-2005:601

Tools & Filters

Nessus	18689 18813 19260 19261 19262 19264 19268 19269 19273 19276 19277 19285 19431 19433 19476 19478 19685 19888 20420 20421 20544 20556

Credit

Unknown or Incomplete

Blogs

Provided by Technorati

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

User Status

Account
- Login
- Sign-Up

Quick Searches

Advertisements

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

© Copyright 2008 Open Source Vulnerability Database (OSVDB), All Rights Reserved.
Privacy Statement - Terms of Use