CVE-2004-0867

Vulnerability

Mozilla Firefox 0.9.2 (and later versions up to 2.x as reported) permits web sites to set cookies for country-specific second-level domains such as .ltd.uk, .plc.uk, and .sch.uk [1]. These domains are effectively public suffixes, but the browser's cookie domain validation does not treat them as such, allowing arbitrary domains to set cookies for a wide range of subdomains under these suffixes. This affects the cookie policy as described in RFC 2109 [2].

Exploitation

A remote attacker can set a cookie for a vulnerable public suffix (e.g., .ltd.uk) from any web site, and this cookie will be sent to all hosts under that suffix when the user visits them. The attacker does not need authentication or any special network position beyond being able to serve a web page that the victim views. By setting a session identifier cookie for the public suffix, the attacker can perform a session fixation attack: the victim's subsequent requests to any site under that suffix will include the attacker-controlled cookie, potentially overriding the legitimate session [1][3].

Impact

Successful exploitation allows the attacker to hijack a victim's HTTP session on any web site that uses the vulnerable public suffix domain. This leads to disclosure or manipulation of sensitive data within the scope of the affected domain. The impact depends on the specific site's functionality, but could include identity theft, data theft, or unauthorized actions on behalf of the victim [1].

Mitigation

Mozilla addressed this issue in Firefox by improving cookie domain checks to reject public suffixes such as .co.uk and .ltd.uk. The fix was tracked in Bugzilla bug 252342 and resolved as fixed in later releases [3]. Users should upgrade to a version of Firefox beyond 2.x that includes the corrected domain validation logic. No workaround is available for unpatched versions.