NVD

Id
14589  
Name
CVE-2010-3171  
Description
The Math.random function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a random number generator that is seeded only once per document object, which makes it easier for remote attackers to track a user, or trick a user into acting upon a spoofed pop-up message, by calculating the seed value, related to a "temporary footprint" and an "in-session phishing attack." NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-5913.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2010-09-15  
Modified Date
2011-07-18  
Seq
2010-3171  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
80764 14589 CVE-2010-3171 20100914 New writeup by Amit Klein (Trusteer): "Cross-domain information leakage in Firefox 3.6.4-3.6.8, Firefox 3.5.10-3.5.11 and Firefox 4.0 Beta1"  View
80765 14589 CVE-2010-3171 http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox  View
80766 14589 CVE-2010-3171 oval:org.mitre.oval:def:7370  View
80767 14589 CVE-2010-3171 43222  View
80768 14589 CVE-2010-3171 http://www.trusteer.com/sites/default/files/Cross_domain_Math_Random_leakage_in_FF_3.6.4-3.6.8.pdf  View
80769 14589 CVE-2010-3171 ADV-2011-0061  View
80770 14589 CVE-2010-3171 https://bugzilla.mozilla.org/show_bug.cgi?id=577512  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36885 JVNDB-2010-002665 複数の Mozilla 製品の Math.random 関数におけるユーザを追跡される脆弱性 複数の Mozilla 製品の JavaScript 実装内にある Math.random 関数は、ドキュメントのオブジェクトごとに一度だけ実行されるランダム数値生成コードを使用しているため、シード値を計算されることにより、ユーザを追跡される、または偽装したポップアップメッセージを作動させユーザをだます脆弱性が存在します。 CVE-2010-3171 45751 CVE-2010-3171 14589 5.8 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002665.html 2010-06-22 2011-01-20 View