CVE-2004-0758

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.

References

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt

http://bugzilla.mozilla.org/show_bug.cgi?id=249004

http://marc.info/?l=bugtraq&m=109900315219363&w=2

http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml

http://www.kb.cert.org/vuls/id/784278

http://www.mozilla.org/projects/security/known-vulnerabilities.html

http://www.novell.com/linux/security/advisories/2004_36_mozilla.html

http://www.redhat.com/support/errata/RHSA-2004-421.html

http://www.securityfocus.com/bid/15495

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127186

https://exchange.xforce.ibmcloud.com/vulnerabilities/16706

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10304

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3134

Details

Source: MITRE

Published: 2004-08-18

Updated: 2017-10-11

Risk Information

CVSS v2

Base Score: 5

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 10

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*

Tenable Plugins

View all (43 total)

IDNameProductFamilySeverity
3239Mozilla Firefox < 1.0.7 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
3238Mozilla Firefox < 1.7.12 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
3099Mozilla Firefox < 1.0.6 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
3067Mozilla Firefox < 1.7.10 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
3066Mozilla Firefox < 1.0.5 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
19024FreeBSD : mozilla -- built-in CA certificates may be overridden (8d823883-0ca9-11d9-8a8a-000c41e2cdad)NessusFreeBSD Local Security Checks
medium
18794Slackware 10.0 / 9.1 / current : Mozilla (SSA:2004-223-01)NessusSlackware Local Security Checks
critical
2902Mozilla Firefox < 1.7.8 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
2887Mozilla Firefox < 1.0.4 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
2789Mozilla Firefox < 1.7.7 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
2788Mozilla Firefox < 1.0.3 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
2703Mozilla Thunderbird < 1.0.2 Multiple Vulnerabilities (deprecated)Nessus Network MonitorSMTP Clients
high
2671Mozilla Firefox < 1.7.6 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
2652Mozilla Firefox < 1.0.1 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
2603MSN Messenger < 6.2.0205 PNG File Remote Overflow (deprecated)Nessus Network MonitorInternet Messengers
high
2602Microsoft Media Player Version 9 PNG Multiple Vulnerabilities (deprecated)Nessus Network MonitorGeneric
high
14668Mozilla Multiple Browsers CA Certificate SSL Page DoSNessusWindows
medium
14578GLSA-200408-22 : Mozilla, Firefox, Thunderbird, Galeon, Epiphany: New releases fix vulnerabilitiesNessusGentoo Local Security Checks
critical
14331Mandrake Linux Security Advisory : mozilla (MDKSA-2004:082)NessusMandriva Local Security Checks
critical
1775Mozilla Firefox XML User Interface Language Browser Interface Spoofing (deprecated)Nessus Network MonitorWeb Clients
high
1773Mozilla Firefox < 1.7.1 / Thunderbird < 0.7.1 POP3 Remote Heap Overflow (deprecated)Nessus Network MonitorWeb Clients
high
1772Mozilla Firefox < 1.7.1 Cross-Domain Frame Loading Vulnerability (deprecated)Nessus Network MonitorWeb Clients
high
1771Mozilla Firefox < 1.7.2 Non-FQDN SSL Certificate SpoofingNessus Network MonitorWeb Clients
high
1770Mozilla Firefox < 1.7.1 SSL Redirect SpoofingNessus Network MonitorWeb Clients
high
2116Mozilla Firefox Input Type HTML Tag Unauthorized Access (deprecated)Nessus Network MonitorWeb Clients
high
14214RHEL 2.1 / 3 : mozilla (RHSA-2004:421)NessusRed Hat Local Security Checks
critical
801373Mozilla XML User Interface Language Browser Interface SpoofingLog Correlation EngineWeb Clients
medium
801318Mozilla Browser < 1.7.8 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801295Mozilla Firefox < 1.0.4 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801294Mozilla Browser < 1.7.12 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801293Mozilla < 1.7.7 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801292Mozilla Browser < 1.7.2 Non-FQDN SSL Certificate SpoofingLog Correlation EngineWeb Clients
medium
801263Mozilla < 1.7.1 SSL Redirect SpoofingLog Correlation EngineWeb Clients
medium
801257Mozilla Browser < 1.7.10 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801229Mozilla Browser Input Type HTML Tag Unauthorized AccessLog Correlation EngineWeb Clients
medium
801228Mozilla < 1.7.1 Cross-Domain Frame Loading VulnerabilityLog Correlation EngineWeb Clients
medium
801221Mozilla Thunderbird < 1.0.2 Multiple VulnerabilitiesLog Correlation EngineSMTP Clients
high
801217Mozilla Firefox < 1.0.5 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801215Mozilla < 1.7.6 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
801211Mozilla Browser <1.7.1 / Thunderbird < 0.7.1 SendUIDL POP3 Message Handling Remote Heap OverflowLog Correlation EngineWeb Clients
medium
800781Firefox < 1.0.7 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
800777Firefox < 1.0.6 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high
800745Firefox < 1.0.3 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
high