CVE-2002-2013 Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla 0.9.6 and earlier and Netscape 6.2 and earlier allows remote attackers to steal cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla | = 0.9.2 | No fix listed |
| mozilla | = 0.9.2.1 | No fix listed |
| mozilla | = 0.9.3 | No fix listed |
| mozilla | = 0.9.4 | No fix listed |
| mozilla | = 0.9.4.1 | No fix listed |
| mozilla | = 0.9.5 | No fix listed |
| mozilla | = 0.9.6 | No fix listed |
| netscape communicator | = 4.0 | No fix listed |
| netscape communicator | = 4.4 | No fix listed |
| netscape communicator | = 4.5 | No fix listed |
| netscape communicator | = 4.5_beta | No fix listed |
| netscape communicator | = 4.06 | No fix listed |
| netscape communicator | = 4.6 | No fix listed |
| netscape communicator | = 4.07 | No fix listed |
| netscape communicator | = 4.7 | No fix listed |
| netscape communicator | = 4.08 | No fix listed |
| netscape communicator | = 4.51 | No fix listed |
| netscape communicator | = 4.61 | No fix listed |
| netscape communicator | = 4.72 | No fix listed |
| netscape communicator | = 4.73 | No fix listed |
| netscape communicator | = 4.74 | No fix listed |
| netscape communicator | = 4.75 | No fix listed |
| netscape communicator | = 4.76 | No fix listed |
| netscape communicator | = 4.77 | No fix listed |
| netscape communicator | = 4.78 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netscape navigator | = 4.77 | No fix listed |
| netscape navigator | = 6.0 | No fix listed |
| netscape navigator | = 6.01 | No fix listed |
| netscape navigator | = 6.1 | No fix listed |
| netscape navigator | = 6.2 | No fix listed |
References
- alive.znep.com exploit
- 20020121 Mozilla Cookie Exploit exploit mailing-list
- mozilla-netscape-steal-cookies(7973) patch vdb-entry
- 3925 patch vdb-entry