CVE

Id
13601  
CVE No.
CVE-2005-2395  
Status
Candidate  
Description
Mozilla Firefox 1.0.4 and 1.0.5 does not choose the challenge with the strongest authentication scheme available as required by RFC2617, which might cause credentials to be sent in plaintext even if an encrypted channel is available.  
Phase
Assigned (20050727)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
98562 13601 CVE-2005-2395 BUGTRAQ:20050719 Mozilla cleartext credentials leak bug report to excuse myself (Re[2]: NTLM HTTP Authentication is insecure by design - a new writeup by Amit Klein)  View
98563 13601 CVE-2005-2395 URL:http://www.securityfocus.com/archive/1/405666  View
98564 13601 CVE-2005-2395 MISC:https://bugzilla.mozilla.org/show_bug.cgi?id=281851  View
98565 13601 CVE-2005-2395 MISC:http://www.securiteam.com/securitynews/5PP0L00GUQ.html  View
98566 13601 CVE-2005-2395 BID:14325  View
98567 13601 CVE-2005-2395 URL:http://www.securityfocus.com/bid/14325  View
98568 13601 CVE-2005-2395 OSVDB:19002  View
98569 13601 CVE-2005-2395 URL:http://www.osvdb.org/19002  View
98570 13601 CVE-2005-2395 SREASON:8  View
98571 13601 CVE-2005-2395 URL:http://securityreason.com/securityalert/8  View
98572 13601 CVE-2005-2395 XF:mozilla-authentication-weakness(22272)  View

Related JVN