CVE-2005-0590: Medium severity Mozilla Thunderbird vulnerability
Published Feb 28, 2005
·Updated
The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.
Affected Software
44 affected components
Mozilla Thunderbird=0.6
Mozilla Firefox=0.8
Mozilla Thunderbird=0.7.2
Mozilla Thunderbird=0.3
Mozilla Mozilla=1.7-alpha
Mozilla Thunderbird=0.2
Mozilla Mozilla=1.7-rc1
Mozilla Mozilla=1.5-rc2
Mozilla Mozilla=1.7
Mozilla Firefox=0.9.1
Mozilla Mozilla=1.7.5
Mozilla Firefox=0.10.1
Mozilla Thunderbird=1.0
Mozilla Firefox=0.9
Mozilla Mozilla=1.6-beta
Mozilla Mozilla=1.4.1
Mozilla Mozilla=1.5-alpha
Mozilla Mozilla=1.5-rc1
Mozilla Mozilla=1.3
Mozilla Firefox=1.0
Mozilla Mozilla=1.7-beta
Mozilla Mozilla=1.4
Mozilla Mozilla=1.5
Mozilla Thunderbird=0.5
Mozilla Thunderbird=0.9
Mozilla Mozilla=1.7.1
Mozilla Thunderbird=0.7.3
Mozilla Firefox=0.9.3
Mozilla Mozilla=1.4-alpha
Mozilla Thunderbird=0.4
Mozilla Thunderbird=0.7
Mozilla Mozilla=1.5.1
Mozilla Firefox=0.9.2
Mozilla Mozilla=1.7.2
Mozilla Thunderbird=0.1
Mozilla Firefox=0.9-rc
Mozilla Mozilla=1.7-rc3
Mozilla Thunderbird=0.7.1
Mozilla Thunderbird=0.8
Mozilla Mozilla=1.7-rc2
Mozilla Firefox=0.10
Mozilla Mozilla=1.7.3
Mozilla Mozilla=1.6-alpha
Mozilla Mozilla=1.6
Remediation
Patch Available
Patch Available
Patch Available
Event History
Feb 28, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0590?
CVE-2005-0590 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2005-0590?
To fix CVE-2005-0590, update your Firefox or Thunderbird to version 1.0.1 or later.
3
What types of software are affected by CVE-2005-0590?
CVE-2005-0590 affects multiple versions of Mozilla Firefox and Thunderbird prior to version 1.0.1 and Mozilla prior to version 1.7.6.
4
What kind of attack does CVE-2005-0590 enable?
CVE-2005-0590 allows remote attackers to spoof the hostname when performing installations.
5
When was CVE-2005-0590 disclosed?
CVE-2005-0590 was disclosed in March 2005.