CVE-2005-0238 The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that us...
MediumCVSS 5.0
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME epiphany | All versions | No fix listed |
| mozilla camino | = 0.8.5 | No fix listed |
| mozilla | <= 1.6 | No fix listed |
| omnigroup omniweb | = 5 | No fix listed |
| opera browser | <= 7.54 | No fix listed |
| debian/epiphany-browser(Debian:12) | < 1.4.8-2 | 1.4.8-2 |
| debian/epiphany-browser(Debian:13) | < 1.4.8-2 | 1.4.8-2 |
| debian/epiphany-browser(Debian:14) | < 1.4.8-2 | 1.4.8-2 |
References
- 20050206 state of homograph attacks exploit mailing-list vendor-advisory
- 12461 broken-link third-party-advisory vdb-entry
- www.shmoo.com broken-link exploit vendor-advisory
- www.shmoo.com broken-link exploit vendor-advisory
- bugzilla.redhat.com broken-link issue-tracking patch third-party-advisory
- multiple-browsers-idn-spoof(19236) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2005-0238 vendor-advisory