Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2004-1316

Overview

Vulnerability Score 5.0 5.0
CVE Id CVE-2004-1316
Last Modified 07 Mar 2011 09:16:54
Published 29 Dec 2004 12:00:00
Confidentiality Impact NONE NONE
Integrity Impact NONE NONE
Availability Impact PARTIAL PARTIAL
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2004-1316

Summary

Heap-based buffer overflow in MSG_UnEscapeSearchUrl in nsNNTPProtocol.cpp for Mozilla 1.7.3 and earlier allows remote attackers to cause a denial of service (application crash) via an NNTP URL (news:) with a trailing '\' (backslash) character, which prevents a string from being NULL terminated.

Vulnerable Systems

Application

  • Mozilla

  • Mozilla 1.3

  • Mozilla 1.4

  • Mozilla 1.4.1

  • Mozilla 1.5

  • Mozilla 1.5.1

  • Mozilla 1.6

  • Mozilla 1.7

  • Mozilla 1.7.1

  • Mozilla 1.7.2

  • Mozilla 1.7.3


References

CONFIRM - http://www.mozilla.org/security/announce/mfsa2005-06.html

XF - mozilla-nntp-bo(18711)

REDHAT - RHSA-2005:038

SUSE - SUSE-SA:2006:004

HP - HPSBTU01114

BUGTRAQ - 20041229 Heap overflow in Mozilla Browser <= 1.7.3 NNTP code.

MISC - http://isec.pl/vulnerabilities/isec-0020-mozilla.txt

BID - 12131

SUSE - SUSE-SA:2006:022

SECUNIA - 19823


Last Updated: 27 May 2016 10:38:59