Mozilla Firefox 2.0.0.1 through 2.0.0.3 does not canonicalize URLs before checking them against the phishing site blacklist, which allows remote attackers to bypass phishing protection via multiple / (slash) characters in the URL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | 2.0.0.1 (including) | 2.0.0.1 (including) |
| Firefox | Mozilla | 2.0.0.2 (including) | 2.0.0.2 (including) |
| Firefox | Mozilla | 2.0.0.3 (including) | 2.0.0.3 (including) |
| Firefox | Ubuntu | dapper | * |
| Firefox | Ubuntu | devel | * |
| Firefox | Ubuntu | edgy | * |
| Firefox | Ubuntu | feisty | * |
| Firefox | Ubuntu | gutsy | * |
| Firefox | Ubuntu | hardy | * |