CVE-2009-1834: Input Validation
Mozilla add-on developer Pavel Cvrcek reported that certain invalid unicode characters, when used as part of an IDN, are displayed as whitespace in the location bar. This whitespace could be used to force part of the URL out of view in the location bar. An attacker could use this vulnerability to spoof the location bar and display a misleading URL for their malicious web page.
Other sources
Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1834?
CVE-2009-1834 has been rated as a moderate severity vulnerability due to the potential for URL tampering.
How do I fix CVE-2009-1834?
To fix CVE-2009-1834, update to the latest version of Mozilla Firefox or SeaMonkey that addresses this vulnerability.
In which software is CVE-2009-1834 found?
CVE-2009-1834 affects multiple versions of Mozilla Firefox and SeaMonkey.
What impact does CVE-2009-1834 have?
CVE-2009-1834 can lead to phishing attacks by obscuring parts of a URL in the browser's location bar.
Is CVE-2009-1834 exploitable remotely?
Yes, CVE-2009-1834 can be exploited remotely through crafted URLs to mislead users.