Description
Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demonstrated by the "." and "/" characters, which is not caught by the Phishing List blacklist filter.
References
- 20070206 Firefox 2.0.0.1 and Opera 9.10 Anty Fraud/Phishing Protection bypass. mailing-list
- https://bugzilla.mozilla.org/show_bug.cgi?id=367538
- 33705 vdb-entry
- 20070418 Firefox 2.0.0.3 Phishing Protection Bypass Vulnerability mailing-list
- http://kaneda.bohater.net/security/20070111-firefox_2.0.0.1_bypass_phishing_protection.php