CVE-2009-0652

Description

The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233. NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected.

5.8

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 2.13% Top 20%

Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory vupen.com

Affected: n/a n/a

References

Link	Tags
http://www.mandriva.com/security/advisories?name=MDVSA-2009:111	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11396	vdb entry signature
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00683.html	vendor advisory
http://secunia.com/advisories/34894	third party advisory vendor advisory
http://www.vupen.com/english/advisories/2009/1125	vdb entry vendor advisory
http://www.debian.org/security/2009/dsa-1830	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48974	vdb entry
http://lists.immunitysec.com/pipermail/dailydave/2009-February/005556.html	mailing list
http://secunia.com/advisories/34096	third party advisory vendor advisory
http://secunia.com/advisories/34844	third party advisory vendor advisory
http://secunia.com/advisories/35065	third party advisory vendor advisory
http://lists.immunitysec.com/pipermail/dailydave/2009-February/005563.html	mailing list
https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf
https://usn.ubuntu.com/764-1/	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html	vendor advisory
http://www.securityfocus.com/bid/33837	vdb entry
http://secunia.com/advisories/35042	third party advisory vendor advisory
http://secunia.com/advisories/34843	third party advisory vendor advisory
http://www.debian.org/security/2009/dsa-1797	vendor advisory
http://rhn.redhat.com/errata/RHSA-2009-0437.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2009-0436.html	vendor advisory
http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike
http://www.mozilla.org/security/announce/2009/mfsa2009-15.html

Frequently Asked Questions

What is the severity of CVE-2009-0652?: CVE-2009-0652 has been scored as a medium severity vulnerability.
How to fix CVE-2009-0652?: To fix CVE-2009-0652, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-0652 being actively exploited in the wild?: It is possible that CVE-2009-0652 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.