CVE-2013-6167

Published: 15 February 2014

Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP response.

Notes

The upstream Mozilla bug is marked as wontfix. This only
affects cookies set via document.cookie (A similar issue for cookies
set via the HTTP Set-Cookie header was fixed in CVE-2016-1939)

Status

References

• http://www.openwall.com/lists/oss-security/2013/10/17/2
• http://www.openwall.com/lists/oss-security/2013/04/03/10
• https://bugzil.la/858215
• http://redmine.lighttpd.net/issues/2188
• https://www.cve.org/CVERecord?id=CVE-2013-6167
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.mozilla.org/show_bug.cgi?id=858215